Netgear Root Compromise via Command Injection

Posted on

At the end of my post on the Netgear wndr3700v4’s authentication bugs, I said to expect followup posts. Once the web interface is unlocked, any further bugs that normally require authentication become fair game. Well good news, everyone!!

Previously, I talked about the net-cgi executable in the wndr3700’s firmware. ;net-cgi is a multi-call binary, a little like busybox. As such it has a lot of functionality baked in. One of its more interesting functions is called cmd_ping6(). Here’s what it looks like:

This is a function that will ping whatever hostname or IPv6 address is passed in as the char *host argument. What you see here is such an unbelievably common pattern, that the first thing you should do with a router’s firmware is check to see if there’s a ping diagnostic page, and verify how ping gets executed.


But what if the target isn’t configured to use IPv6? Who cares? The ping6 command doesn’t actually need to succeed. As long as the injected command string gets passed to system(), that’s all that matters.

So how does this function get invoked?



How does cgi_commit() know to call cmd_ping6()? That happens when when apply.cgi is requested as a post, and the post data contains “submit_flag=ping6”.


There is a page that sends a post request to apply.cgi with the ping6 submit flag. That page is “ping6_traceroute6_hidden_info.htm”.


Send a shell command instead of an IP address.
Form is submitted with "ping6_text=`reboot`"


This page is not exposed to the user via any reference in the web interface, and it even has “hidden” in the name. Hidden as it may be, it can’t hide from Python. I’ve written up some proof-of-concept exploit code that will access this page and start up a telnet server, allowing you to log in unauthenticated as root.


The exploit code does the following:

  1. Fingerprint the device to ensure it’s vulnerable.
  2. Disable authentication.

You can download the proof-of-concept exploit code[2] from my GitHub repo. You’ll need Bowcaster installed.

[2] Don’t attempt to test this against devices you don’t own. That’s illegal in most jurisdictions.