Exploit-DB #48588
Description: Netgear R7000 Router - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-06-15
Author: grimm-co

Exploit:
# EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48588.zip
#
# Exploits a pre-authentication memcpy based stack buffer overflow vulnerability
# in httpd on several devices and versions:
#
#   Device      Version               httpd md5sum                      Exploit status
#   AC1450      V1.0.0.36_10.0.17     c105a629d55d3f7b29d6b88e2cc6ff3a  Untested
#   AC1450      V1.0.0.34_10.0.16     b01fa2155dbe3d37c0d244f2a258b797  Untested
#   AC1450      V1.0.0.22_1.0.10      8327b4ccf3c3ea1281f5beb932f308bb  Untested
#   AC1450      V1.0.0.14_1.0.6       a199bd85a19fbfe360e967c889fb0a83  Untested
#   AC1450      V1.0.0.8_1.0.4        c1f64b91722efa50452d6842a5e97f77  Untested
#   AC1450      V1.0.0.6_1.0.3        1b043477b16d5bbd2be3d4b7c4430953  Untested
#   D6220       V1.0.0.52_1.0.52      4c63e0a531ddf60310faf99702226c37  Untested
#   D6220       V1.0.0.48_1.0.48      2efa4dfdb0901ffe4b99555e2ddeca32  Untested
#   D6220       V1.0.0.46_1.0.46      2911f178060efcda3644be4bc7f25249  Untested
#   D6220       V1.0.0.44_1.0.44      3ea0dbb8e22d0e4daf3f12d5bb26ab64  Untested
#   D6220       V1.0.0.40_1.0.40      ef47f7085976c65890991eb67bbd31f7  Untested
#   D6220       V1.0.0.36_1.0.36      06c1b6ff9bac3e5c583f71f8cb63bd3a  Untested
#   D6220       V1.0.0.34_1.0.34      9a1fcd70a952b63ea874a826793e11ba  Untested
#   D6220       V1.0.0.32_1.0.32      5f9b38b2e4afcff3117f3f4d1bc454f4  Untested
#   D6220       V1.1.0.28_1.0.28      5fa7890b766cbd6233043a601bdc990c  Untested
#   D6220       V1.0.0.24_1.0.24      1d8cfa4843dd9c4f1b1360beca080a81  Untested
#   D6220       V1.0.0.22_1.0.22      3d1916d41b6e1e728238e5def8723b3e  Untested
#   D6220       V1.0.0.16_1.0.16      d5d19a4e7ba57850e4c09a01766cde3a  Untested
#   D6300       V1.0.0.102_1.0.102    8dd49d875e2683e396dc67381fadd057  Tested
#   D6300       V1.0.0.96_1.1.96      5caa6056af76330fc0292657f192cb69  Untested
#   D6300       V1.0.0.90_1.0.90      6196e4b48c9337fd5b89f527262f81dc  Tested
#   D6300       V1.0.0.88-1.0.88      d65d7d6db8a240bed2c845f9ce5ef8ed  Untested
#   D6300       V1.0.0.76_1.0.76      b4c98cc8ff8d9cd3c4a1f65c5c5f0fde  Untested
#   D6300       V1.0.0.72_1.0.72      d0690f900a0fa29b38266b04de51869e  Untested
#   D6300       V1.0.0.42_1.0.42      e86b7593f1e6d59f49fe4948379d0d69  Untested
#   D6300       V1.0.0.30_1.0.30      f3691a3179fcd7390b62398f365a4c1a  Untested
#   D6300       V1.0.0.24_1.0.24      33cad70c5c307950fffded6c8f64066b  Untested
#   D6300       V1.0.0.16_1.0.16      55f4d6ac42eff8014254eadce033faac  Untested
#   D6400       V1.0.0.88_1.0.88      a9a31bd500dc6542969e039283b4f44f  Untested
#   D6400       V1.0.0.86_1.0.86      6ef83c99c829dc7e7d0a0907d3ed71a8  Untested
#   D6400       V1.0.0.82_1.0.82      33c63fc65ecba162e8acbb85bed0dda0  Untested
#   D6400       V1.0.0.80_1.0.80      4d9a3533b6e7afddfb2060649e44d092  Untested
#   D6400       V1.0.0.78_1.0.78      6de4a742f7c7edd7241deda0fdfd5ab4  Untested
#   D6400       V1.0.0.74_1.0.74      e692a2670b133efb293ecc3e3f9c82b4  Untested
#   D6400       V1.0.0.70_1.0.70      a9a0cd9ebb6e45671b03a291f79cfaf0  Untested
#   D6400       V1.0.0.68_1.0.68      226c662ecbf01f524cf0c0537220d652  Untested
#   D6400       V1.0.0.66_1.0.66      a1986e8fe5c270d2e8a3f9416b086a85  Untested
#   D6400       V1.0.0.60_1.0.60      1f74db16784172b4e8b385149b7b730c  Untested
#   D6400       V1.0.0.58_1.0.58      e62704fc3cec8611afc[PII_REDACTED]3d2  Untested
#   D6400       V1.0.0.56_1.0.56      b02401e956d4160c59a2f59a31da51bc  Untested
#   D6400       V1.0.0.54_1.0.54      632e9d26af86341f2eea25248e298b8c  Untested
#   D6400       V1.0.0.52_1.0.52      c54e25d1dcd814c44ee29b26337ca140  Untested
#   D6400       V1.0.0.44_1.0.44      9b5cca485ed56ade5cb3d556c8bb975b  Untested
#   D6400       V1.0.0.38_1.1.38      b5729e40e61563f7a1a29359e0f9c78c  Untested
#   D6400       V1.0.0.34_1.3.34      5628ae2ce9326a63b050e96b6aa3fb79  Untested
#   D6400       V1.0.0.22_1.0.22      1dc99a4d0952f648f1dab07d5cdd2a60  Untested
#   D7000v2     V1.0.0.56_1.0.1       a35f742d1d7ebf7c882fa71bc6cd4d74  Untested
#   D7000v2     V1.0.0.53_1.0.2       27d115ede639511d2eda25114dd82a5b  Untested
#   D7000v2     V1.0.0.52_1.0.1       827190546bcae129c56334674af3f669  Untested
#   D7000v2     V1.0.0.51_1.0.1       0583d3f1fd97d3616a9e1448be12ee16  Untested
#   D7000v2     V1.0.0.47_1.0.1       4880a731183fce2b4d47c5064c6d7236  Untested
#   D7000v2     V1.0.0.45_1.0.1       2f1bc9a39d033d10c9ae73c299353524  Untested
#   D7000v2     V1.0.0.44_1.0.1       7d37548ceda1aeb2a163b9616ecfc156  Untested
#   D7000v2     V1.0.0.40_1.0.1       095c32dae5741f5342f5b5aaeeac6206  Untested
#   D7000v2     V1.0.0.38_1.0.1       acca219a67790af0897f8ca6f1bd949f  Untested
#   D8500       V1.0.3.44_1.0.1      [PII_REDACTED]6378cb0bcef38414d5640a  Untested
#   D8500       V1.0.3.43_1.0.1       b71e3b8eb1aedd615aafc9311dd36886  Untested
#   D8500       V1.0.3.42_1.0.1       a567caf426cc76cd11ec3c3053519c8f  Untested
#   D8500       V1.0.3.39_1.0.1       ff56ddb8126f5aa1dfc4d85d2eeafce4  Untested
#   D8500       V1.0.3.36_1.0.1       862a04b37c61fa9cadff8754d9f3abb2  Untested
#   D8500       V1.0.3.35_1.0.1       16d4ab7b3357bda7e68a79b5b9022c4d  Untested
#   D8500       V1.0.3.28_1.0.1       94bbb72e108e68a774746a97cc7c00c0  Untested
#   D8500       V1.0.3.27_1.0.1       822427e336366dd83c018e541d1d2d4f  Untested
#   D8500       V1.0.3.25_1.0.1       ddd3c3f02d1286f26344265d6db1bea5  Untested
#   DC112A      V1.0.0.44_1.0.60      e4721b08c70fcdc3dd1048cee49c2118  Untested
#   DC112A      V1.0.0.30_1.0.60      c11c0fb597c234e682fbbf3f5ba00d90  Untested
#   DC112A      V1.0.0.24_1.0.60      b2b677dff87eab44b4972ff4948532e6  Untested
#   DGN2200     V1.0.0.58_7.0.57      db21e42ca1bf1878192fa7b1627b065a  Tested
#   DGN2200     V1.0.0.57_7.0.57      b5e9360ea0411e3e01e2901ec1c14c61  Untested
#   DGN2200