Remote code execution in several NETGEAR Cable Modems



Risk High
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2019-19494
CWE-ID CWE-119
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 C6250EMR
Hardware solutions / Routers for home users

CG3700EMR
Hardware solutions / Routers for home users

Vendor NETGEAR

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU24232

Risk: High

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2019-19494

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing packets sent to spectrum analyzer build-in feature. By default the affected router accepts requests from local network only, however an attacker can craft a specially crafted webpage and use victim's browser to deliver malicious request to the affected router, e.g. via websockets and a specially crafted JSON payload.

Successful exploitation of this vulnerability may result in complete compromise of the affected router.

Note, this vulnerability was dubbed Cable Haunt by the researcher.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

C6250EMR: 2.01.03 - 2.01.05

CG3700EMR: 2.01.03 - 2.01.05

CPE2.3 External links

https://cablehaunt.com
https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf
https://github.com/Lyrebirds/Fast8690-exploit
https://www.broadcom.com


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.



###SIDEBAR###