^{CVE-2016-11022:}Remote Code Execution in NETGEAR Prosafe Wireless Controllers

Overview

This vulnerability (CVE-2016-11022) is classified as CWE-78 (OS Command Injection) affecting NETGEAR Prosafe Wireless Controllers. The vulnerability exists in the login_handler.php script which fails to properly sanitize user input in the reqMethod parameter. By sending specially crafted requests containing shell metacharacters to this parameter, remote attackers can execute arbitrary commands on the underlying operating system with root privileges. This vulnerability is particularly severe as it can be exploited without authentication and provides the highest level of system access. The vulnerability has been observed being exploited in the wild, including by Mirai malware variants targeting enterprise networks.

Remediation

1. Update affected NETGEAR Prosafe Wireless Controllers to the latest firmware versions that address this vulnerability.
2. If immediate patching is not possible, implement network-level protections:
   • Place the management interfaces of these devices behind a firewall
   • Restrict access to the web interface to trusted IP addresses only
   • Implement network segmentation to isolate these devices from untrusted networks
3. Monitor for suspicious activities or unauthorized access attempts targeting these devices
4. Consider implementing a web application firewall (WAF) to filter malicious requests containing command injection attempts
5. Regularly audit system logs for signs of compromise or exploitation attempts

References

1. Original vulnerability disclosure: http://firmware.re/vulns/acsa-2015-002.php
2. Exploit code available in RouterSploit: https://github.com/threat9/routersploit/blob/master/routersploit/modules/exploits/routers/netgear/prosafe_rce.py
3. Palo Alto Networks report on Mirai variant exploiting this vulnerability: https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/
4. NETGEAR security advisories and firmware updates: Check NETGEAR's official support website for the latest security patches for affected models