CVE-2014-2962

Description

Absolute path traversal vulnerability in the webproc cgi module on the Belkin N150 F9K1009 v1 router with firmware before 1.00.08 allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Belkin N150 Router 1.00.08/1.00.09 - Directory Traversal EDB-38488 · webapps · Oct 19, 2015

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Belkin N150 Router 1.00.08/1.00.09 - Path Traversal http/cves/2014/CVE-2014-2962.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References

38488 exploit
VU#774788 third-party-advisory
http://www.belkin.com/us/support-article?articleNum=109400