Sign-up

ID

VAR-201312-0127


CVE

CVE-2013-4776


TITLE

plural NETGEAR ProSafe Service operation interruption in switch product firmware (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2013-005622

DESCRIPTION

NETGEAR ProSafe GS724Tv3 and GS716Tv2 with firmware 5.4.1.13 and earlier, GS748Tv4 5.4.1.14, and GS510TP 5.0.4.4 allows remote attackers to cause a denial of service (reboot or crash) via a crafted HTTP request to filesystem/. NetGear ProSafe is a smart switch product that monitors and configures the network. Successfully exploiting this issue allows remote attackers to cause denial-of-service conditions. The following ProSafe products are vulnerable: GS724Tv3 firmware version 5.4.1.13 GS716Tv2 firmware version 5.4.1.13 GS724Tv3 firmware version 5.4.1.10 GS716Tv2 firmware version 5.4.1.10 GS748Tv4 firmware version 5.4.1.14 GS510TP firmware version 5.0.4.4. 1. BACKGROUND According to the vendor, Netgear ProSafe is a cost-effective line of smart switches for Small and Medium Businesses (SMBs). The products cover an essential set of network features and easy-to-use web-based management. Power over Ethernet (PoE) and Stacking versions are also available. 2. SUMMARY A range of ProSafe switches are affected by two different vulnerabilities: CVE-2013-4775: Unauthenticated startup-config disclosure. CVE-2013-4776: Denial of Service vulnerability. 3. VULNERABILITIES The list below describes the vulnerabilities discovered in the affected software. 4.1 CVE-2013-4775: Unauthenticated startup-config disclosure The web management application fails to restrict URL access to different application areas. [Proof of Concept] The vulnerability can be exploited with a simple HTTP (GET) request. Open a browser and visit http://Target-IP/filesystem/startup-config 4.2 CVE-2013-4776: Denial of Service vulnerability The affected products are prone to a Denial of Service vulnerability. [Proof of Concept] The vulnerability can be exploited with a simple HTTP (GET) request. Open a browser and visit http://Target-IP/filesystem/ Implementation of a Proof of Concept for both vulnerabilities can be found here: http://www.encripto.no/tools/netgear-prosafe-PoC.tar.gz 5. REMEDIATION No firmware updates or fixes have been released yet. As a mitigation, the vendor recommends configuring a separate management VLAN and configure access control via \x93Security::Access::Access Control\x94 or \x93Security::ACL::Advanced::IP Extended Rules\x94. 6. CREDIT The vulnerabilities were originally discovered in a GS724Tv3 device, by Juan J. G\xfcelfo at Encripto AS. E-mail: post [at] encripto [dot] no Web: http://www.encripto.no Special thanks to Maarten Hoogcarspel and the Netgear Support Team for verifying other switch models, and considering possible fixes. For more information about Encripto\x92s research policy, please visit http://www.encripto.no/forskning/ 7. REFERENCES http://www.encripto.no/forskning/whitepapers/Netgear_prosafe_advisory_aug_2013.pdf http://www.encripto.no/tools/netgear-prosafe-PoC.tar.gz DISCLAIMER The material presented in this document is for educational purposes only. Encripto AS cannot be responsible for any loss or damage carried out by any technique presented in this material. The reader is the only one responsible for applying this knowledge, which is at his / her own risk. Any of the trademarks, service marks, collective marks, design rights, personality rights or similar rights that are mentioned, used or cited in this document is property of their respective owners

Trust: 2.61

sources: NVD: CVE-2013-4776 // JVNDB: JVNDB-2013-005622 // CNVD: CNVD-2013-12566 // BID: 61924 // VULHUB: VHN-64778 // PACKETSTORM: 122904

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-12566

AFFECTED PRODUCTS

vendor:netgearmodel:prosafescope:eqversion:5.4.1.14

Trust: 1.6

vendor:netgearmodel:prosafescope:eqversion:5.3.0.17

Trust: 1.6

vendor:netgearmodel:prosafescope:eqversion:5.4.1.10

Trust: 1.6

vendor:netgearmodel:prosafescope:eqversion:5.0.4.4

Trust: 1.6

vendor:netgearmodel:prosafescope:eqversion:5.4.0.6

Trust: 1.6

vendor:netgearmodel:prosafe gs748tscope:eqversion:v4

Trust: 1.0

vendor:netgearmodel:prosafe gs510tpscope:eqversion: -

Trust: 1.0

vendor:netgearmodel:prosafescope:lteversion:5.4.1.13

Trust: 1.0

vendor:netgearmodel:prosafe gs724tscope:eqversion:v3

Trust: 1.0

vendor:netgearmodel:prosafe s716tscope:eqversion:v2

Trust: 1.0

vendor:net gearmodel:gs510tpscope: - version: -

Trust: 0.8

vendor:net gearmodel:gs716tscope:eqversion:v2

Trust: 0.8

vendor:net gearmodel:gs724tscope:eqversion:v3

Trust: 0.8

vendor:net gearmodel:gs748tscope:eqversion:v4

Trust: 0.8

vendor:net gearmodel:prosafescope:eqversion:5.0.4.4 (gs510tp)

Trust: 0.8

vendor:net gearmodel:prosafescope:lteversion:5.4.1.13 (gs716t v2)

Trust: 0.8

vendor:net gearmodel:prosafescope:lteversion:5.4.1.13 (gs724t v3)

Trust: 0.8

vendor:net gearmodel:prosafescope:eqversion:5.4.1.14 (gs748t v4)

Trust: 0.8

vendor:netgearmodel:prosafe switchesscope: - version: -

Trust: 0.6

vendor:netgearmodel:prosafescope:eqversion:5.4.1.13

Trust: 0.6

sources: CNVD: CNVD-2013-12566 // JVNDB: JVNDB-2013-005622 // CNNVD: CNNVD-201312-397 // NVD: CVE-2013-4776

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-4776
value: HIGH

Trust: 1.0

NVD: CVE-2013-4776
value: HIGH

Trust: 0.8

CNVD: CNVD-2013-12566
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201312-397
value: HIGH

Trust: 0.6

VULHUB: VHN-64778
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2013-4776
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-12566
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-64778
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2013-12566 // VULHUB: VHN-64778 // JVNDB: JVNDB-2013-005622 // CNNVD: CNNVD-201312-397 // NVD: CVE-2013-4776

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2013-4776

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201312-397

TYPE

Failure to Handle Exceptional Conditions

Trust: 0.3

sources: BID: 61924

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-005622

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-64778

PATCH
title:スイッチ製品url:http://www.netgear.jp/products/business/switch
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-005622

EXTERNAL IDS
db:NVDid:CVE-2013-4776
Trust: 3.6
db:BIDid:61924
Trust: 1.0
db:JVNDBid:JVNDB-2013-005622
Trust: 0.8
db:CNNVDid:CNNVD-201312-397
Trust: 0.7
db:CNVDid:CNVD-2013-12566
Trust: 0.6
db:SEEBUGid:SSVID-81367
Trust: 0.1
db:EXPLOIT-DBid:27775
Trust: 0.1
db:VULHUBid:VHN-64778
Trust: 0.1
db:PACKETSTORMid:122905
Trust: 0.1
db:PACKETSTORMid:122904
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-12566 // 
            
            
            
            VULHUB: VHN-64778 // 
            
            
            
            BID: 61924 // 
            
            
            
            JVNDB: JVNDB-2013-005622 // 
            
            
            
            PACKETSTORM: 122905 // 
            
            
            
            PACKETSTORM: 122904 // 
            
            
            
            CNNVD: CNNVD-201312-397 // 
            
            
            
            NVD: CVE-2013-4776

REFERENCES
url:http://www.encripto.no/forskning/whitepapers/netgear_prosafe_advisory_aug_2013.pdf
Trust: 2.6
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4776
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4776
Trust: 0.8
url:http://seclists.org/bugtraq/2013/aug/141
Trust: 0.6
url:http://www.netgear.com
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2013-4775
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2013-4776
Trust: 0.2
url:http://target-ip/filesystem/startup-config
Trust: 0.1
url:http://target-ip/filesystem/
Trust: 0.1
url:http://www.encripto.no/tools/netgear-prosafe-poc.tar.gz
Trust: 0.1
url:http://www.encripto.no
Trust: 0.1
url:http://www.encripto.no/forskning/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-12566 // 
            
            
            
            VULHUB: VHN-64778 // 
            
            
            
            BID: 61924 // 
            
            
            
            JVNDB: JVNDB-2013-005622 // 
            
            
            
            PACKETSTORM: 122905 // 
            
            
            
            PACKETSTORM: 122904 // 
            
            
            
            CNNVD: CNNVD-201312-397 // 
            
            
            
            NVD: CVE-2013-4776

CREDITS
Juan J. Güelfo of Encripto AS
Trust: 0.3
sources:
            
            
            BID: 61924

SOURCES
db:CNVDid:CNVD-2013-12566
db:VULHUBid:VHN-64778
db:BIDid:61924
db:JVNDBid:JVNDB-2013-005622
db:PACKETSTORMid:122905
db:PACKETSTORMid:122904
db:CNNVDid:CNNVD-201312-397
db:NVDid:CVE-2013-4776

LAST UPDATE DATE
2025-04-11T23:11:58.578000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-12566date:2013-08-26T00:00:00
db:VULHUBid:VHN-64778date:2013-12-19T00:00:00
db:BIDid:61924date:2013-08-21T00:00:00
db:JVNDBid:JVNDB-2013-005622date:2013-12-20T00:00:00
db:CNNVDid:CNNVD-201312-397date:2013-12-25T00:00:00
db:NVDid:CVE-2013-4776date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2013-12566date:2013-08-26T00:00:00
db:VULHUBid:VHN-64778date:2013-12-19T00:00:00
db:BIDid:61924date:2013-08-21T00:00:00
db:JVNDBid:JVNDB-2013-005622date:2013-12-20T00:00:00
db:PACKETSTORMid:122905date:2013-08-22T02:13:52
db:PACKETSTORMid:122904date:2013-08-22T02:11:50
db:CNNVDid:CNNVD-201312-397date:2013-12-25T00:00:00
db:NVDid:CVE-2013-4776date:2013-12-19T04:24:51.823