CVE-2014-0659
Cisco RVS4000, WRVS4400N, and WAP4410N Firmware - Remote Code Execution via Test Interface
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-0659.
PoCs published by Metasploit, including Metasploit module auxiliary/scanner/misc/sercomm_backdoor_scanner.
AI-analyzed exploit summary This Metasploit module exploits a backdoor in SerComm devices (e.g., NetGear DG834) via TCP port 32764, allowing remote code execution by sending a crafted payload to the backdoor service. It supports both MIPS big and little endian targets.
Description
The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.
Exploits (3)
This Metasploit module exploits a backdoor in SerComm devices (e.g., NetGear DG834) via TCP port 32764, allowing remote code execution by sending a crafted payload to the backdoor service. It supports both MIPS big and little endian targets.
This Metasploit auxiliary module scans for the presence of a backdoor in SerComm network devices by sending a random 5-byte string to port 32764 and checking the response for specific signatures indicating endianness.
This Metasploit module exploits a backdoor in SerComm devices (e.g., NetGear, Linksys, Cisco, Honeywell) via TCP port 32764, allowing remote code execution by sending a crafted payload to the vulnerable service. The exploit supports multiple architectures (MIPS BE/LE) and devices, with configurable payload encoding and execution methods.