CVE-2013-10061

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-10061
An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameter in the setup.cgi endpoint. The vulnerability arises from improper input neutralization, enabling command injection through crafted POST requests. This flaw enables remote attackers to deploy payloads or manipulate system state post-authentication.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb Exploit
https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005 Exploit Third Party Advisory
https://www.exploit-db.com/exploits/24464 Exploit
https://www.exploit-db.com/exploits/24931 Exploit
https://www.vulncheck.com/advisories/netgear-legacy-routers-rce-2 Third Party Advisory
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb Exploit
https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005 Exploit Third Party Advisory
https://www.exploit-db.com/exploits/24464 Exploit
https://www.exploit-db.com/exploits/24931 Exploit
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:netgear:dgn1000b_firmware:1.1.00.24:*:*:*:*:*:*:*
cpe:2.3:o:netgear:dgn1000b_firmware:1.1.00.45:*:*:*:*:*:*:*
cpe:2.3:h:netgear:dgn1000b:-:*:*:*:*:*:*:*
History

23 Sep 2025, 23:30

Type Values Removed Values Added
References () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb - () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb - Exploit
References () https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005 - () https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005 - Exploit, Third Party Advisory
References () https://www.exploit-db.com/exploits/24464 - () https://www.exploit-db.com/exploits/24464 - Exploit
References () https://www.exploit-db.com/exploits/24931 - () https://www.exploit-db.com/exploits/24931 - Exploit
References () https://www.vulncheck.com/advisories/netgear-legacy-routers-rce-2 - () https://www.vulncheck.com/advisories/netgear-legacy-routers-rce-2 - Third Party Advisory
First Time Netgear dgn1000b Firmware
Netgear
Netgear dgn1000b
CPE cpe:2.3:o:netgear:dgn1000b_firmware:1.1.00.24:*:*:*:*:*:*:*
cpe:2.3:h:netgear:dgn1000b:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:dgn1000b_firmware:1.1.00.45:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2

06 Aug 2025, 15:15

Type Values Removed Values Added
References () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb - () https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb -
References () https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005 - () https://web.archive.org/web/20150218074318/http://www.s3cur1ty.de/m1adv2013-005 -
References () https://www.exploit-db.com/exploits/24464 - () https://www.exploit-db.com/exploits/24464 -
References () https://www.exploit-db.com/exploits/24931 - () https://www.exploit-db.com/exploits/24931 -

04 Aug 2025, 15:06

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de inyección de comandos del sistema operativo autenticado en los routers Netgear (probados en las versiones de firmware 1.1.00.24 y 1.1.00.45 del modelo DGN1000B) a través del parámetro TimeToLive del endpoint setup.cgi. La vulnerabilidad se debe a una neutralización incorrecta de la entrada, lo que permite la inyección de comandos mediante solicitudes POST manipuladas. Esta falla permite a atacantes remotos implementar payloads o manipular el estado del sistema tras la autenticación.

01 Aug 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-01 21:15

Updated : 2025-09-23 23:30

NVD link : CVE-2013-10061

Mitre link : CVE-2013-10061

CVE.ORG link : CVE-2013-10061

JSON object : View

Products Affected

netgear

  • dgn1000b_firmware
  • dgn1000b
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')