Chiwopsezo cha Remote Code Execution mu Netgear Routers

Chiwopsezo chadziwika pazida za Netgear zomwe zimakupatsani mwayi wogwiritsa ntchito nambala yanu ndi ufulu wa mizu popanda kutsimikizika kudzera muzosintha pamaneti akunja kumbali ya mawonekedwe a WAN. Kusatetezeka kwatsimikiziridwa mu R6900P, R7000P, R7960P ndi R8000P ma routers opanda zingwe, komanso mu MR60 ndi MS60 ma mesh zipangizo. Netgear yatulutsa kale zosintha za firmware zomwe zimakonza chiwopsezo.

Chiwopsezochi chimadza chifukwa chakusefukira kwa mulu wakumbuyo aws_json (/tmp/media/nand/router-analytics/aws_json) popanga data mumtundu wa JSON wolandiridwa pambuyo potumiza pempho ku intaneti yakunja (https://devicelocation. ngxcld.com/device -location/resolve) amagwiritsidwa ntchito kudziwa malo a chipangizocho. Kuti muwononge, muyenera kuyika fayilo yopangidwa mwapadera mu mtundu wa JSON pa seva yanu ya intaneti ndikukakamiza rauta kutsitsa fayiloyi, mwachitsanzo, kudzera mu DNS spoofing kapena kulozeranso pempho ku node yodutsa (muyenera kuletsa a pempho kwa wolandirayo devicelocation.ngxcld.com adapanga chipangizocho chikayamba ). Pempholi limatumizidwa pa protocol ya HTTPS, koma osayang'ana kutsimikizika kwa satifiketi (potsitsa, gwiritsani ntchito zopindika ndi "-k").

Kumbali yothandiza, chiwopsezocho chingagwiritsidwe ntchito kusokoneza chipangizo, mwachitsanzo, pakuyika chitseko chakumbuyo kuti chiwongolere maukonde amkati mwabizinesi. Kuti muwukire, ndikofunikira kuti mupeze mwayi wofikira kwakanthawi kochepa wa Netgear rauta kapena chingwe cha netiweki / zida kumbali ya WAN mawonekedwe (mwachitsanzo, kuwukirako kutha kuchitidwa ndi ISP kapena wowukira yemwe wapeza mwayi wolowera chishango cha kulumikizana). Monga chiwonetsero, ofufuza akonza chipangizo chowukira chotengera chotengera Raspberry Pi board, chomwe chimalola munthu kupeza chipolopolo cha mizu polumikiza mawonekedwe a WAN a rauta osatetezeka ku doko la Ethernet la board.

Source: opennet.ru

Kuwonjezera ndemanga