Description
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoe_username parameter. This flaw allows full compromise of the device and may persist across reboots unless configuration is restored.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Netgear | DGN2200B | ≤ 1.0.0.36 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Netgear DGN2200B pppoe.cgi Remote Command Execution
exploit/linux/http/netgear_dgn2200b_pppoe_exec
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb exploit
- https://www.exploit-db.com/exploits/24513 exploit
- https://www.exploit-db.com/exploits/24974 exploit
- https://web.archive.org/web/20170422033239/http://www.s3cur1ty.de/m1adv2013-015 technical-description exploit
- https://www.vulncheck.com/advisories/netgear-legacy-routers-rce third-party-advisory