CVE-2019-12511: Root Command Injection via MAC Address in SOAP API
First published: Mon Feb 24 2020(Updated: )
In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled, and a valid authentication JWT, additional vulnerabilities (CVE-2019-12510) allow an attacker to interact with the entire SOAP API without authentication. Additionally, DNS rebinding techniques may be used to exploit this vulnerability remotely. Exploiting this vulnerability is somewhat involved. The following limitations apply to the payload and must be overcome for successful exploitation: - No more than 17 characters may be used. - At least one colon must be included to prevent mangling. - A single-quote and meta-character must be used to break out of the existing command. - Parent command remnants after the injection point must be dealt with. - The payload must be in all-caps. Despite these limitations, it is still possible to gain access to an interactive root shell via this vulnerability. Since the web server assigns certain HTTP headers to environment variables with all-caps names, it is possible to insert a payload into one such header and reference the subsequent environment variable in the injection point.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netgear Nighthawk X10-r9000 Firmware | <1.0.4.26 | |
| NETGEAR Nighthawk X10-R9000 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-12511?
The severity of CVE-2019-12511 is critical.
How can an attacker exploit CVE-2019-12511?
An attacker can exploit CVE-2019-12511 by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC, allowing them to execute arbitrary system commands as root.
Which devices are affected by CVE-2019-12511?
NETGEAR Nighthawk X10-R9000 devices prior to firmware version 1.0.4.26 are affected by CVE-2019-12511.
How can I fix CVE-2019-12511?
To fix CVE-2019-12511, users should update their NETGEAR Nighthawk X10-R9000 firmware to version 1.0.4.26 or later.
Is the NETGEAR Nighthawk X10-R9000 device vulnerable to CVE-2019-12511?
The NETGEAR Nighthawk X10-R9000 device is vulnerable to CVE-2019-12511 if it is running a firmware version prior to 1.0.4.26.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/references
- agent/weakness
- agent/severity
- agent/first-publish-date
- agent/last-modified-date
- agent/description
- agent/event
- agent/tags
- agent/source
- vendor/netgear
- canonical/netgear nighthawk x10-r9000 firmware
- canonical/netgear nighthawk x10-r9000