Full title: Netgear DGN1000B setup.cgi Remote Command Execution Vulnerability 
Category: remote exploits
Platform: hardware
Some Netgear Routers are vulnerable to authenticated OS Command injection. The vulnerability exists in the web interface, specifically in the setup.cgi component, when handling the TimeToLive parameter. Default credentials are always a good starting point, admin/admin or admin/password could be a first try. Since it is a blind os command injection vulnerability, there is no output for the executed command when using the cmd generic payload. A ping command against a controlled system could be used for testing purposes.

# 0day.today @ http://0day.today/