This vulnerability was analyzed during Episode 175 on 12 December 2022
A couple command injection bugs on the NetGear RAX30 router, straight forward IoT bugs.
The first, is in the DHCPREQUEST packet, the hostname is taken from the request, and filled into a lease structure. That lease structure is then used and the hostname sprintf‘d into a command line that is passed into system. Allowing an attacker to breakout and inject their own commands to be run.
The second issue, this one reachable on the WAN side, but requires a well-positioned attacker is in the firmwire upgrade process. On boot, the pucfu binary is run, and it makes a request over HTTPS to NetGear. In response it receives the URL for firmware upgrades and caches it. Later the pufwUpgrade binary is executed that reads the cached URL and downloads the file.
There are two problems, first is that despite using HTTPS the request explicitly turns certificate validation off. So a well-positioned attacker may be able to redirect or otherwise tamper with the response. The second issue is that like with the DHCPREQUEST this URL that is read from the cache is simply sprintf‘d into a command line string, allowing an attacker to escape and gain code execution.