# Exploit Title: [Netgear Voice Gateway Multiple Vulnerabilities]
# Date: May 01, 2015 [No response from Vendor]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [www.netgear.com]
# Version: [Firmware Version: V126.96.36.199_2.3.23]
*Netgear Voice Gateway Multiple Vulnerabilities *
*Device Info *
Device Type: Netgear Voice Gateway EVG2000
Account Name: EVG2000
Firmware Version: V188.8.131.52_2.3.23
*1. Web application vulnerabilities OS Command Injection *
Netgear Voice Gateway EVG2000 is managed through a web management portal.
The application provides a Diagnostics feature that has four (4) options:
a.Ping an IP address
b.Perform a DNS Lookup
c.Display the Routing Table
d.Reboot the Router
Option 1 Ping an IP address was confirmed to be vulnerable to OS Command
The ping_IPAddr parameter does not sufficiently validate input. It is
possible to use the semi-colon character (;) to inject arbitrary OS
commands and retrieve the output in the application's responses.
*HTTP POST Request*
POST /ping.cgi HTTP/1.1
Authorization: Basic <b64_value_here>
*2. Web application vulnerabilities Stored Cross-Site Scripting (XSS) *
In the Services menu, the Service Table lists any existing Service-Port
mappings. A new service can be added with a payload value of
*<script>alert(xss)</script>* in the ServiceType parameter.
The application does not check any malicious input and accepted this new
request for the Services Table Entries.
The web application lacks strict input validation and hence is vulnerable
to Stored Cross-Site Scripting attack.
*3. Application does not secure configured passwords (HTTP) *
Any & all configured sensitive information such as passwords & keys are not
secured properly. These are masked and only ***** is shown in the
This client-side restriction can easily be bypassed though. It is possible
to capture masked values via ‘Inspect Element’ and / or via an intercepting
The application should mask/censure (*****) the passwords, keys and any
other crucial pieces of configuration and must not pass the values in