Other nomination

Zach Cutlip -- Remote Code Execution in Netgear routers

Dennis Fisher · Threatpost | The first stop for security news · 25 October 2013

Zach Cutlip found a command injection in the Netgear WNDR3700v4: cmd_ping6() sprintf()s an attacker-supplied host into a shell string passed to system(), so "; evil_command; #" runs as root. Chained with his separate /BRS_02_genieHelp.html bypass, which disables admin authentication across reboots, it gives unauthenticated root on firmware 1.0.1.32 and 1.0.1.42.

Record

Researcher

Dennis Fisher

Published by

Threatpost | The first stop for security news

Date

25 October 2013

In the archive

• Nominated for the 2013 Top 10 Web Hacking Techniques

Related sources

• Researcher’s proof-of-concept

Tags

• command-injection
• auth-bypass
• rce
• injection
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Dennis Fisher, first published at the original source. Preserved copies are kept so the citation survives its host.