Sign-up

ID

VAR-201312-0100


CVE

CVE-2013-2751


TITLE

NETGEAR ReadyNAS RAIDiator of FrontView Web Any in the interface Perl Code execution vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2013-005518

DESCRIPTION

Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow.". NetGear RAIDiator is a direct-hanging storage device based on Linux and debian-sparc platforms. A cross-site request forgery vulnerability exists in NetGear RAIDiator. Allow remote attackers to perform certain administrative actions. Other attacks are also possible. Following are vulnerable: RAIDiator versions prior to 4.1.12 running on SPARC RAIDiator-x86 versions prior to 4.2.24. There is an eval injection vulnerability in the FrontViewWeb interface in NETGEAR ReadyNAS RAIDiator 4.1 and 4.2.23 and earlier versions. The vulnerability is caused by the frontview/lib/np_handler.pl script not filtering the input submitted by the user

Trust: 2.52

sources: NVD: CVE-2013-2751 // JVNDB: JVNDB-2013-005518 // CNVD: CNVD-2013-14091 // BID: 62059 // VULHUB: VHN-62753

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-14091

AFFECTED PRODUCTS

vendor:netgearmodel:raidiatorscope:ltversion:4.1.12

Trust: 1.0

vendor:netgearmodel:raidiatorscope:gteversion:4.2

Trust: 1.0

vendor:netgearmodel:raidiatorscope:gteversion:4.1

Trust: 1.0

vendor:netgearmodel:raidiatorscope:ltversion:4.2.24

Trust: 1.0

vendor:net gearmodel:readynas ultra 2/plusscope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas 2100scope: - version: -

Trust: 0.8

vendor:net gearmodel:raidiatorscope:eqversion:4.2.24

Trust: 0.8

vendor:net gearmodel:readynas pro 4scope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas 3200scope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas pro 6scope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas 4200scope: - version: -

Trust: 0.8

vendor:net gearmodel:raidiatorscope:ltversion:4.2.x

Trust: 0.8

vendor:net gearmodel:readynas proscope:eqversion:pioneer edition

Trust: 0.8

vendor:net gearmodel:readynas nvxscope:eqversion:pioneer edition

Trust: 0.8

vendor:net gearmodel:readynas 1500scope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas ultra 4/plusscope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas nvxscope:eqversion:none

Trust: 0.8

vendor:net gearmodel:readynas proscope:eqversion:business edition

Trust: 0.8

vendor:net gearmodel:readynas ultra 6/plusscope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas 3100scope: - version: -

Trust: 0.8

vendor:net gearmodel:readynas pro 2scope: - version: -

Trust: 0.8

vendor:netgearmodel:readynas raidiatorscope:eqversion:4.1.11

Trust: 0.6

vendor:netgearmodel:readynas raidiatorscope:eqversion:4.2.23

Trust: 0.6

vendor:netgearmodel:raidiatorscope:eqversion:4.2.23

Trust: 0.6

vendor:netgearmodel:raidiatorscope:eqversion:4.1

Trust: 0.6

vendor:netgearmodel:raidiatorscope:eqversion:4.2.20

Trust: 0.6

vendor:netgearmodel:raidiatorscope:eqversion:4.2.15

Trust: 0.6

sources: CNVD: CNVD-2013-14091 // JVNDB: JVNDB-2013-005518 // CNNVD: CNNVD-201312-247 // NVD: CVE-2013-2751

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-2751
value: HIGH

Trust: 1.0

NVD: CVE-2013-2751
value: HIGH

Trust: 0.8

CNVD: CNVD-2013-14091
value: LOW

Trust: 0.6

CNNVD: CNNVD-201312-247
value: CRITICAL

Trust: 0.6

VULHUB: VHN-62753
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-2751
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-14091
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-62753
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2013-14091 // VULHUB: VHN-62753 // JVNDB: JVNDB-2013-005518 // CNNVD: CNNVD-201312-247 // NVD: CVE-2013-2751

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.9

sources: VULHUB: VHN-62753 // JVNDB: JVNDB-2013-005518 // NVD: CVE-2013-2751

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201312-247

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201312-247

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-005518

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-62753

PATCH
title:Top Pageurl:http://www.netgear.com/
Trust: 0.8
title:RAIDiator 4.2.24 (x86)url:http://www.readynas.com/?p=7002
Trust: 0.8
title:Patch for NetGear RAIDiator Cross-Site Request Forgery Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/40540
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-14091 // 
            
            
            
            JVNDB: JVNDB-2013-005518

EXTERNAL IDS
db:NVDid:CVE-2013-2751
Trust: 3.5
db:PACKETSTORMid:123726
Trust: 1.8
db:OSVDBid:98826
Trust: 1.7
db:EXPLOIT-DBid:29815
Trust: 1.7
db:BIDid:62059
Trust: 0.9
db:JVNDBid:JVNDB-2013-005518
Trust: 0.8
db:CNNVDid:CNNVD-201312-247
Trust: 0.7
db:CNVDid:CNVD-2013-14091
Trust: 0.6
db:PACKETSTORMid:124169
Trust: 0.1
db:SEEBUGid:SSVID-83294
Trust: 0.1
db:VULHUBid:VHN-62753
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-14091 // 
            
            
            
            VULHUB: VHN-62753 // 
            
            
            
            BID: 62059 // 
            
            
            
            JVNDB: JVNDB-2013-005518 // 
            
            
            
            PACKETSTORM: 123726 // 
            
            
            
            CNNVD: CNNVD-201312-247 // 
            
            
            
            NVD: CVE-2013-2751

REFERENCES
url:http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/
Trust: 1.9
url:http://www.exploit-db.com/exploits/29815
Trust: 1.7
url:http://packetstormsecurity.com/files/123726/netgear-readynas-complete-system-takeover.html
Trust: 1.7
url:http://www.readynas.com/?p=7002
Trust: 1.7
url:http://www.tripwire.com/register/security-advisory-netgear-readynas/
Trust: 1.7
url:http://www.osvdb.org/98826
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2751
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-2751
Trust: 0.8
url:http://www.securityfocus.com/bid/62059
Trust: 0.6
url:http-request/
Trust: 0.6
url:http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-
Trust: 0.6
url:http://www.netgear.com
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2013-2752
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2751
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-14091 // 
            
            
            
            VULHUB: VHN-62753 // 
            
            
            
            BID: 62059 // 
            
            
            
            JVNDB: JVNDB-2013-005518 // 
            
            
            
            PACKETSTORM: 123726 // 
            
            
            
            CNNVD: CNNVD-201312-247 // 
            
            
            
            NVD: CVE-2013-2751

CREDITS
Craig Young
Trust: 0.4
sources:
            
            
            BID: 62059 // 
            
            
            
            PACKETSTORM: 123726

SOURCES
db:CNVDid:CNVD-2013-14091
db:VULHUBid:VHN-62753
db:BIDid:62059
db:JVNDBid:JVNDB-2013-005518
db:PACKETSTORMid:123726
db:CNNVDid:CNNVD-201312-247
db:NVDid:CVE-2013-2751

LAST UPDATE DATE
2025-04-11T22:48:27.404000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-14091date:2013-10-28T00:00:00
db:VULHUBid:VHN-62753date:2019-07-18T00:00:00
db:BIDid:62059date:2013-11-26T07:56:00
db:JVNDBid:JVNDB-2013-005518date:2013-12-17T00:00:00
db:CNNVDid:CNNVD-201312-247date:2019-07-19T00:00:00
db:NVDid:CVE-2013-2751date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2013-14091date:2013-10-28T00:00:00
db:VULHUBid:VHN-62753date:2013-12-12T00:00:00
db:BIDid:62059date:2013-07-05T00:00:00
db:JVNDBid:JVNDB-2013-005518date:2013-12-17T00:00:00
db:PACKETSTORMid:123726date:2013-10-23T00:00:17
db:CNNVDid:CNNVD-201312-247date:2013-12-17T00:00:00
db:NVDid:CVE-2013-2751date:2013-12-12T18:55:10.807