Security News > 2021 > September > Third Critical Bug Affects Netgear Smart Switches — Details and PoC Released
New details have been revealed about a recently remediated critical vulnerability in Netgear smart switches that could be leveraged by an attacker to potentially execute malicious code and take control of vulnerable devices.
The disclosure comes weeks after NETGEAR released patches to address the vulnerabilities earlier this month, on September 3.
Successful exploitation of Demon's Cries and Draconian Fear could grant a malicious party the ability to change the administrator password without actually having to know the previous password or hijack the session bootstrapping information, resulting in a full compromise of the device.
Now, in a new post sharing technical specifics about Seventh Inferno, Coldwind noted that the flaw relates to a newline injection flaw in the password field during Web UI authentication, effectively enabling the attacker to create fake session files, and combine it with a reboot Denial of Service and a post-authentication shell injection to get a fully valid session and execute any code as root user, thereby leading to full device compromise.
The reboot DoS is a technique designed to reboot the switch by exploiting the newline injection to write "2" into three different kernel configurations - "/proc/sys/vm/panic on oom," "/proc/sys/kernel/panic," and "/proc/sys/kernel/panic on oops" - in a manner that causes the device to compulsorily shut down and restart due to kernel panic when all the available RAM is consumed upon uploading a large file over HTTP. "This vulnerability and exploit chain is actually quite interesting technically," Coldwind said.
"In short, it goes from a newline injection in the password field, through being able to write a file with constant uncontrolled content of '2', through a DoS and session crafting, to an eventual post-auth shell injection."
News URL
http://feedproxy.google.com/~r/TheHackersNews/~3/O38K3ZiFVdw/third-critical-bug-affects-netgear.html