PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Our Pwn2Own journey against time and randomness (part 2)

blog.quarkslab.com | research | #firmware | #vulnerability | #netgear | #pwn2own | #disclosure | #router
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of Quarkslab's Pwn2Own Toronto journey: LAN-side vulnerabilities in the Netgear RAX30 — a soap_serverd buffer overflow (CVE-2023-27368), a DoS flaw and a firmware signature bypass.
Published
Collected

Related coverage

research · blog.quarkslab.com
Our Pwn2Own journey against time and randomness (part 1)
Part one of Quarkslab's Pwn2Own Toronto 2022 journey: how the team picked targets for the router category, and its vulnerability research on the Netgear RAX30's WAN interface.
blog · blog.viettelcybersecurity.com
The first step to PWN2OWN - A sad one
A researcher's first find: LAN-side command injection in the NETGEAR RAX30 UPnP service via a malicious SOAPACTION header embedded into a logger command; patched just before Pwn2Own Toronto 2022.
vulnerability · blog.viettelcybersecurity.com
NETGEAR R6700v3: 1day Analysis (CVE-2021-34982) Buffer Overflow RCE Vulnerability
The author traces CVE-2021-34982 on NETGEAR R6700v3 to Create_Hashtable() in the httpd String File Table Upload handler: unvalidated gui_region overflows a stack buffer, enabling pre-auth root RCE.
research · blog.quarkslab.com
Reverse Engineering a VxWorks OS Based Router
A reverse engineering walkthrough of a TP-Link TL-WR543G router running VxWorks: firmware extraction, binary analysis, memory layout and the pitfalls encountered along the way.
research · blog.quarkslab.com
TCP backdoor 32764 or how we could patch the Internet (or part of it ;))
The 32764 router backdoor: unauthenticated remote shell and credential dumping, a scan finding it open on about a million IPv4 hosts, and a way to permanently remove it from Linksys WAG200G routers.
research · swarm.ptsecurity.com
Slowburn: Looking through AMD Platform Configuration Blobs infrastructure
A deep dive into AMD Platform Configuration Blocks (APCB v1-v3) in motherboard SPI flash on an ASUS TUF Gaming A18, covering headers and structures via OpenSIL; started as a vulnerability write-up.
Back