Exploitation Summary
EIP tracks 3 public exploits for CVE-2013-10061.
PoCs published by Metasploit, m-1-k-3, including Metasploit module exploits/linux/http/netgear_dgn1000b_setup_exec.
AI-analyzed exploit summary This Metasploit module exploits an authenticated OS command injection vulnerability in Netgear DGN1000B routers via the setup.cgi component. It leverages the TimeToLive parameter to execute arbitrary commands, supporting both direct command execution and MIPS payload deployment.
Description
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.
Exploits (3)
This Metasploit module exploits an authenticated OS command injection vulnerability in Netgear DGN1000B routers via the setup.cgi component. It leverages the TimeToLive parameter to execute arbitrary commands, supporting both direct command execution and MIPS payload deployment.
This exploit demonstrates an OS command injection vulnerability in Netgear DGN1000B routers via the TimeToLive parameter in the UPNP configuration. It also includes details on insecure cryptographic storage and XSS vulnerabilities.
This Metasploit module exploits an authenticated OS command injection vulnerability in Netgear DGN1000B routers via the setup.cgi component's TimeToLive parameter. It supports both direct command execution and staged payload delivery for MIPS-based systems.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H