CVE-2013-10060

Published: Aug 1, 2025Modified: Sep 23, 2025

9.4

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN2200B model) firmware versions 1.0.0.36 and prior via the pppoe.cgi endpoint. A remote attacker with valid credentials can execute arbitrary commands via crafted input to the pppoe_username parameter. This flaw allows full compromise of the device and may persist across reboots unless configuration is restored.

Affected (1)

Products: Netgear: Dgn2200b Firmware

1 product

Dgn2200b Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Dgn2200b Firmware	Up to 1.1.0.36

Running on/with	Platform Versions
Netgear Dgn2200b	All versions

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (9)

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb

Source: disclosure@vulncheck.com

Exploit

https://web.archive.org/web/20170422033239/http://www.s3cur1ty.de/m1adv2013-015

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/24513

Source: disclosure@vulncheck.com

Exploit

https://www.exploit-db.com/exploits/24974

Source: disclosure@vulncheck.com

Exploit

https://www.vulncheck.com/advisories/netgear-legacy-routers-rce

Source: disclosure@vulncheck.com

Third Party Advisory

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn2200b_pppoe_exec.rb

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

https://web.archive.org/web/20170422033239/http://www.s3cur1ty.de/m1adv2013-015

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/24513

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

https://www.exploit-db.com/exploits/24974

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

Timeline

No history available yet.