Threat database

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing_tab_add_cgi, routing_table_list_show_cgi, route_policy_add_cgi, and route_policy_parame_show_cgi. Attackers can inject persistent script payloads through these route and NAT configuration pages, which are then executed in the context of users viewing the affected pages.

Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and related ddns_Proc.c components, enabling os command argument injection. Attackers can exploit the unsanitized parameters to inject additional command arguments executed with root privileges.

Netcore NR255-V version 1.5.130703 has a null pointer dereference vulnerability in its QoS setter CGI handlers due to unchecked atoi() results. This flaw can be triggered by an attacker supplying crafted input, leading to a denial of service condition.

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval() in qos_xianz_add_cgi, qos_xianz_show_cgi, qos_filter_add_cgi, and qos_filter_show_cgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is later processed by the affected handlers.'

Netcore NR255-V version 1.5.130703 has a vulnerability where authenticated users with broad roles can access QoS read routes to disclose sensitive live network telemetry beyond their intended privileges. This is due to incorrect authorization in handling mod_qos_bandwidth plan.json within specific CGI components.

Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the Nettools tcpdump launch paths, including ntools_start_set_cgi, ntools_tcpdump_start_set_cgi, exe_default, and ntools_proc components. Attackers can inject crafted arguments into these tcpdump launch routines to manipulate executed system commands on the device.

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code.

Netcore NR255-V version 1.5.130703 has a stack-based buffer overflow vulnerability in the wake_up_set.cgi component. This occurs due to unbounded tokenization of MAC and ID inputs, allowing crafted values to overflow the stack buffer and corrupt program memory. The vulnerability has a high severity with a CVSS score of 8.7.

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can exploit this flaw via ui_config_2.xml and misc.js to disclose router credentials.

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting (XSS) vulnerability in the ddns_wan_list_show.cgi component. This vulnerability arises from unsafe use of eval() on DDNS data, allowing attackers to inject malicious scripts that persist and execute when the affected page is viewed. The CVSS score is 4.8, indicating a medium severity issue.

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSset_cgi, IGD_GetCgiHandler, and IGD_CgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing sensitive account information.

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent.

Netcore NR255-V version 1.5.130703 has a vulnerability that allows unauthorized actors to access sensitive personal information through audit endpoints. Specifically, attackers can query audit components to retrieve other users' session and browsing history data across sessions. This exposure of private information poses a high-severity risk.

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential handling. Attackers can query this component to obtain captive-portal user credentials, compromising confidentiality of authenticated network access.

Netcore NR268 firmware version 1.7.121109 has a security check bypass vulnerability due to missing support for integrity check in the restore archive prefix validation. This flaw allows attackers with limited privileges to bypass restrictions on restore archive handling by exploiting a flawed prefix check in the put_parame_file_cgi.c component.

Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in mtd_write allowing forged firmware authenticity checks. Attackers can exploit put_file.cgi and check_image_uuid.c to bypass firmware signature validation and load unauthorized firmware images.

A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. Exact version boundaries remain undocumented. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. This backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.