NETGEAR ReadyNAS Remote Unauthenticated Command Execution

critical Nessus Plugin ID 70585

Language:

Synopsis

The remote host is affected by a command execution vulnerability.

Description

The remote NETGEAR ReadyNAS device is affected by a flaw in the np_handler.pl script that allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges.

Solution

Upgrade the software on the device to version 4.2.24 or higher.

Plugin Details

Severity: Critical

ID: 70585

File Name: netgear_readynas_rce.nasl

Version: 1.11

Type: remote

Family: CGI abuses

Published: 10/24/2013

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:netgear:raidiator, cpe:/h:netgear:readynas_raidiator

Required KB Items: installed_sw/Netgear WWW

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 7/12/2013

Vulnerability Publication Date: 10/22/2013

Exploitable With

Metasploit (NETGEAR ReadyNAS Perl Code Evaluation)

Reference Information

CVE: CVE-2013-2751

BID: 62059

Detections

Analytics