Trustwave SpiderLabs Security Advisory TWSL2018-004: Vulnerabilities in NETGEAR Nighthawk X4S router (R7800) Published: 02/07/2018 Version: 1.0 Vendor: NETGEAR (www.netgear.com) Product: Nighthawk X4S Smart WiFi Gaming Router AC2600 (R7800) Version affected: V1.0.2.28 Product description: Nighthawk X4S AC2600 Smart WiFi Router delivers WiFi to multiple devices simultaneously for faster speeds. Finding 1: OS command injection during WPS setup NETGEAR Nighthawk X4S AC2600 Smart WiFi Router allows users to join its wireless network via Wi-Fi Protected Setup (WPS). When a user presses WPS button the router allows WPS-capable clients to connect during 2 minute period without providing any credentials (expected behavior for WPS). However due to a bug in the router's firmware, this also allows WPS clients to execute arbitrary code on the router as root during the same setup phase. In other words, if an attacker can press the WPS button on the router, the router is completely compromised. Here is a simple proof-of-concept for Linux client system (verified on Kali Linux 2017.1). Boot the live system and add a file /etc/wpa_supplicant.conf with the following content: ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 update_config=1 device_name=MR" /sbin/reboot " In a terminal issue commands: pkill wpa_supplicant wpa_supplicant -B -Dwext -iwlan0 -c/etc/wpa_supplicant.conf Now push the WPS button on the router and type in: wpa_cli wps_pbc wpa_cli wps_pbc NETGEAR In the last command replace NETGEAR with actual name of the network. Notice that the router reboots. In this example device_name has the reboot command injected. There is a 32 character limit on the attribute's length, but it is still long enough to submit a command like curl to download and execute arbitrary code. Remediation Steps: Please visit the NETGEAR link in the references section to see if your model router is affected and how to download patched firmware. Revision History: 03/16/17 - Vulnerability disclosed 10/03/17 - Patch released by vendor 02/07/18 - Advisory published References 1. https://kb.netgear.com/000049354/Security-Advisory-for-Command-Injection-Vulnerability-on-D7000-EX6200v2-and-Some-Routers-PSV-2017-2181 About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.