Sign In
Advisories

Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi

Go Back
severity
high
date
Affecting

  • NR268 1.7.121109

CWE
  • CWE-353 Missing Support for Integrity Check
CVSS
7.2
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
Zhou Ao, Yin Luxing, Jiang Yuxuan, Liu Xin, @Nebusec
Description
Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix validation. Attackers can exploit the flawed prefix check in put_parame_file_cgi.c to bypass restricted restore archive handling.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo