CVE-2013-10061

Published: Aug 1, 2025Modified: Sep 23, 2025

8.6

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.

Affected (2)

Products: Netgear: Dgn1000b Firmware

1 product

Dgn1000b Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Dgn1000b Firmware	Version 1.1.00.24
Netgear Dgn1000b Firmware	Version 1.1.00.45

Running on/with	Platform Versions
Netgear Dgn1000b	All versions

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (9)

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb

Source: disclosure@vulncheck.com

Exploit

https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005

Source: disclosure@vulncheck.com

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/24464

Source: disclosure@vulncheck.com

Exploit

https://www.exploit-db.com/exploits/24931

Source: disclosure@vulncheck.com

Exploit

https://www.vulncheck.com/advisories/netgear-legacy-routers-rce-2

Source: disclosure@vulncheck.com

Third Party Advisory

https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

https://www.exploit-db.com/exploits/24464

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

https://www.exploit-db.com/exploits/24931

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Exploit

Timeline

No history available yet.