Introduction
While testing internet-connected devices for vulnerabilities, our team discovered a Denial of Service (DoS) condition in a Netgear router’s web management interface that can be triggered by unauthenticated network users and disrupt service for devices downstream.
Timeline
- Discovered vulnerability in April
- Got in initial contact with NETGEAR and provided the documented finding/report on May 14th
- NETGEAR confirmed report was received and asked for a public disclosure date of September 11th on May 20th
- NETGEAR reported a CVE has been assigned and will be published in October release on September 24th
- NETGEAR asked for a disclosure extension to October 14th on October 7th
- NETGEAR communicates that the disclosure will be released in a November security update
- NETGEAR does not release a disclosure or responses to requests for more information
- NETGEAR communicates that a disclosure will be included in their December security update
Identifying Services and Enumeration
We began by performing enumeration on the device which included port scanning. Like many routers and Internet of Things (IoT) devices there was a web application that was running that can be accessed to perform management actions on the router. This web application was enumerated to understand how the application works and locate points of interaction.
Attempting to get and update firmware
This NetGear router does not have the option to get and update the firmware version while in the application unlike many of the other routers NetGear sells. So, the next step is to reach out to NetGear for support in updating the firmware, but it is not that easy. NetGear reported that it is not their responsibility and for us to reach out to our ISP for support. Well, when doing that we get the same answers from the ISP.
This leads to the rabbit hole of trying to get the firmware off of the device manually which did not go as planned.
uart firmware extraction
So first let's take apart the router and get to the circuit board in an attempt to find UART interface. UART (Universal Asynchronous Receiver/Transmitter) is a hardware communication interface commonly found on circuit boards that provides low-level serial access to a device. In embedded systems such as routers, UART ports are often exposed on the board for debugging or development purposes, allowing engineers to monitor boot logs, interact with the bootloader, or issue diagnostic commands.
In this case we have the UART ports soldered close. Once these were removed new pins were able to be soldered in which allowed us access to the UART terminal. Once this was accessed it was discovered that the port did not allow interactive access so we can only see what is going on and not perform commands. Since there is no interaction we cannot get the firmware this way. The next step would be attempting to remove the chip and performing a Chip-Off firmware extraction which was not performed during the testing.
SMB vulnerability
Since the UART connection did not prove useful we looked in other ways to potentially gain a shell on the device. When enumerating the device there is a feature where you can add a USB to the device and the router will act as a file share. Whis is enabled we can see that Samba is now able to be accessed. Judging on the versioning information returned, the Samba version may be vulnerable to CVE-2017-7494 which is a remote code execution (RCE) vulnerability for Samba versions 3.5 - 4.6.4. After attempting to exploit this vulnerability it was determined the version running was not vulnerable so there was no access.
Discovered Vulnerability
During the enumeration on the web application it was discovered that there is a page that is used to get into the admin account in the event the admin password was lost at /goform/Unauth. This will take a POST request that takes 4 parameters:
- serialNumber
- NextContinue
- Continue
- unauthsession
This page was then tested further, and it was discovered that if the `unauthsession` parameter was removed from the request it would cause the router to crash and reboot causing a DoS condition. The affected firmware version is V1.02.01, which is not the most up to date version.
Final Thoughts
While the firmware was unable to be updated to newer versions, this vulnerability may be in versions later than the tested version 1.02.01.. At the end of the day this NetGear router does contain an unauthenticated DoS vulnerability that can be leveraged by any user on the network. Due to how difficult it was to update the firmware it is likely that many routers are packaged with this vulnerable version and are not being updated.