""ET EXPLOIT Attempted Netgear Buffer Overflow into RCE Inbound M2""

SID: 2030631

Revision: 2

Class Type: attempted-admin

Metadata: affected_product Netgear_Router, created_at 2020_07_31, deployment Perimeter, confidence High, signature_severity Major, tag Exploit, updated_at 2020_07_31

Reference:

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HTTP_SERVERS,$HOME_NET]

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "/upgrade_check.cgi" Depth: 18

  • Value: "/bin/"

  • Value: "Content-Length|3a 20|"

  • Value: "|0d 0a|"

Within: 3

PCRE: "/^\/upgrade_check.cgi$/U"

Special Options:

  • http_method

  • http_uri

  • fast_pattern

  • http_client_body

  • http_header

source