CVE-2013-10061: Netgear Routers setup.cgi RCE
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-10061?
CVE-2013-10061 is considered to have a high severity due to its potential for OS command injection.
How do I fix CVE-2013-10061?
To fix CVE-2013-10061, update the firmware of your Netgear DGN1000B router to the latest version that addresses this vulnerability.
What devices are affected by CVE-2013-10061?
CVE-2013-10061 specifically affects Netgear DGN1000B routers running firmware versions 1.1.00.24 and 1.1.00.45.
Can CVE-2013-10061 be exploited remotely?
Yes, CVE-2013-10061 can be exploited remotely by attackers if they have access to the router's web interface.
What could an attacker achieve with CVE-2013-10061?
An attacker exploiting CVE-2013-10061 could execute arbitrary OS commands on the affected Netgear router.