Netcore NBR200V2 Router Authenticated Command Injection via network_tools ubus service

Netcore NBR200V2 Router Vulnerability Summary Vulnerability Overview Vulnerability Type: Authenticated Command Injection (CWE-78) Vulnerable Location: handler function (located at , MIPS16 architecture), belonging to the ubus service (registered as , running with root privileges) Root Cause: The user-controllable parameter is not filtered or sanitized in any way, and is passed directly to the function to execute a command template. Trigger Mechanism: Achieve arbitrary command execution by sending a POST request to the ubus JSON-RPC endpoint , invoking the method on the object, and supplying a crafted parameter. Scope of Impact Vendor: Netcore Product: Netcore NBR200V2 Firmware Version: V1.3.241127.071246 (LEDE 17.01, mipsel / MT7621) Prerequisites for Exploitation: Requires a valid web session (can be obtained via using the web credentials configured on the device). Remediation No specific remediation measures were provided on the page. Recommendations include: Perform strict input validation and filtering on the parameter, blocking special characters such as , , , , etc. Avoid using to execute strings containing user input; switch to safer functions like . Upgrade the firmware to the official patched version. POC / Exploitation Code No complete POC code or exploitation script was included on the page. Only snippets of assembly code (MIPS16 disassembly) were displayed, with the key parts as follows: ```asm text:00401E2C loc_00401E2C: text:00401E2C addiu $sp, $sp, 0xC4 text:00401E2E move $s0, $a0 text:00401E30 lw $s0, 0xC4+command($sp) text:00401E32 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E34 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E36 addiu $sp, 0xC4+arg1+0x10000000($s0) text:00401E38 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E3A lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E3C lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E3E lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E40 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E42 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E44 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E46 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E48 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E4A lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E4C lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E4E lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E50 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E52 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E54 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E56 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E58 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E5A lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E5C lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E5E lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E60 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E62 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E64 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E66 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E68 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E6A lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E6C lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E6E lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E70 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E72 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E74 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E76 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E78 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E7A lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E7C lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E7E lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E80 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E82 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E84 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E86 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E88 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E8A lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E8C lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E8E lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E90 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E92 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E94 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E96 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401E98 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401E9A lw $a3, 0xC4+arg1+0x10000000($s0) text:00401E9C lw $a0, 0xC4+arg1+0x10000000($s0) text:00401E9E lw $a1, 0xC4+arg1+0x10000000($s0) text:00401EA0 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401EA2 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401EA4 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401EA6 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401EA8 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401EAA lw $a3, 0xC4+arg1+0x10000000($s0) text:00401EAC lw $a0, 0xC4+arg1+0x10000000($s0) text:00401EAE lw $a1, 0xC4+arg1+0x10000000($s0) text:00401EB0 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401EB2 lw $a3, 0xC4+arg1+0x10000000($s0) text:00401EB4 lw $a0, 0xC4+arg1+0x10000000($s0) text:00401EB6 lw $a1, 0xC4+arg1+0x10000000($s0) text:00401EB8 lw $a2, 0xC4+arg1+0x10000000($s0) text:00401EBA lw $a3, 0xC4+arg1+0x10000000($s0) text:00401EBC lw $a0, 0xC4+arg1+0x10000000($s0) text:00401EBE lw $a1, 0xC4+arg1+0x10000000($s0) text:00401EC0 lw $a2, 0xC4+a

Goal Reached Thanks to every supporter — we hit 100%!

Netcore NBR200V2 Router Authenticated Command Injection via network_tools ubus service

More from this source