Basic Information

• Vendor: Netcore
• Vendor Website: https://www.netcoretec.com/service-support/support
• Model: NBR200V2
• Firmware Version: V1.3.241127.071246
• Firmware Download: https://www.netcoretec.com/service-support/download/firmware/2705.html
• Affected Component: /www/cgi-bin/acbackup

Description

Netcore NBR200V2 firmware V1.3.241127.071246 contains a remote command injection vulnerability in the backup and restore CGI endpoint. The script URL-decodes attacker-controlled query-string data and feeds attacker-derived parameter names into eval. The decoder does not neutralize newline-based shell syntax, so a remote attacker can inject arbitrary shell commands through a crafted request. The vulnerability can be used to reboot the router, interrupt services, or obtain arbitrary code execution.

Technical Details

Vulnerability chain:

1. The CGI handler decodes attacker-controlled input:

QUERY_STRING=`urldecode "$QUERY_STRING"`

1. The decoder rewrites percent-encoded data using printf:

str=${str//[\"\'\`|\\<>@?*~!();,.\$\^]/}
str=${str//%/\\x}
str=`printf "$str"`

1. The resulting key is evaluated as shell syntax:

while [ true ]; do
    param=${QUERY_STRING%%&*}
    QUERY_STRING=${QUERY_STRING#*&}
    val=${param#*=}
    key=${param%=*}
    eval "${key}='${val}'"
    ...
done

1. The sink is again:

eval "${key}='${val}'"

• This is the same root cause as in www/cgi-bin/upgrade, but it is a distinct endpoint and should be treated as a separate vulnerability.