Exploitation Summary
EIP tracks 3 public exploits for CVE-2013-10060.
PoCs published by Metasploit, m-1-k-3, including Metasploit module exploits/linux/http/netgear_dgn2200b_pppoe_exec.
AI-analyzed exploit summary This Metasploit module exploits an authenticated OS command injection vulnerability in Netgear DGN2200B routers via the pppoe.cgi interface. It allows remote command execution by injecting commands into the pppoe_username parameter.
Description
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoe_username parameter. This flaw allows full compromise of the device and may persist across reboots unless configuration is restored.
Exploits (3)
This Metasploit module exploits an authenticated OS command injection vulnerability in Netgear DGN2200B routers via the pppoe.cgi interface. It allows remote command execution by injecting commands into the pppoe_username parameter.
This exploit demonstrates an OS command injection vulnerability in Netgear DGN2200B routers via the `pppoe_username` parameter, allowing arbitrary shell command execution. It also includes details on insecure cryptographic storage and stored XSS vulnerabilities.
This Metasploit module exploits an authenticated OS command injection vulnerability in Netgear DGN2200B routers via the pppoe.cgi interface. It allows remote command execution by injecting commands into the PPPoE configuration parameters.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H