CVE-2016-10176: NETGEAR WNR2000 authentication bypass and RCE in uhttpd

CVE-2016-10176 · Severity: critical · CVSS 9.8 · Published 2017-01-30

A vulnerability in several NETGEAR router models allows unauthorized individuals to take full control of the device over the network. By accessing a hidden management URL, an attacker can change settings, steal the administrator password, or execute malicious code. This could lead to a complete compromise of the home or business network, allowing attackers to intercept traffic or use the device for further attacks.

Technologies: NETGEAR WNR2000v3, NETGEAR WNR2000v4, NETGEAR WNR2000v5. Vendors: NETGEAR.

Quick answers

Is CVE-2016-10176 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-10176 being exploited in the wild.
How severe is CVE-2016-10176?
Critical severity, with a CVSS score of 9.8, published 30 January 2017.
Which products and versions are affected?
NETGEAR WNR1000v4 All firmware versions prior to 1.1.0.46; NETGEAR WNR2000v3 All firmware versions prior to 1.0.2.62; NETGEAR WNR2000v4 All firmware versions prior to 1.0.0.62; NETGEAR WNR2020 All firmware versions prior to 1.1.0.48.
Is there a fix for CVE-2016-10176?
A patch was published on 2017-01-26: Production firmware updates released for WNR2000 series Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-10176 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-10176?
Check whether you run NETGEAR WNR1000v4, NETGEAR WNR2000v3, NETGEAR WNR2000v4 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists within the embedded web server (uhttpd) which exposes an unauthenticated CGI endpoint, 'apply_noauth.cgi', mirroring the functionality of the authenticated 'apply.cgi'. While some sensitive actions require a 'timestamp' variable acting as an anti-CSRF token, the token generation relies on a weak PRNG that can be brute-forced in fewer than 1,000 attempts. Furthermore, a stack buffer overflow was discovered in the handling of these requests. An unauthenticated attacker can combine the authentication bypass, token prediction, and buffer overflow to achieve remote code execution (RCE) with root privileges. This is exploitable via the LAN by default, or via the WAN if remote management is enabled.

Affected products

  • NETGEAR WNR2000v5 All firmware versions prior to 1.0.0.42
  • NETGEAR WNR2000v4 All firmware versions prior to 1.0.0.62
  • NETGEAR WNR2000v3 All firmware versions prior to 1.0.2.62
  • NETGEAR WNR2020 All firmware versions prior to 1.1.0.48
  • NETGEAR WNR1000v4 All firmware versions prior to 1.1.0.46

Timeline

  • 2016-12-20: disclosed: Initial 0-day disclosure by researcher Pedro Ribeiro
  • 2016-12-22: advisory: NETGEAR published initial security advisory PSV-2016-0255
  • 2017-01-26: patched: Production firmware updates released for WNR2000 series
  • 2017-01-30: advisory: CVE-2016-10176 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.