Netgear Management System NMS300, version 126.96.36.199 and earlier, is vulnerable to arbitrary file upload, which may be leveraged by unauthenticated users to execute arbitrary code with SYSTEM privileges. A directory traversal vulnerability enables authenticated users to download arbitrary files.
Netgear Management System NMS300 is a configuration, monitoring, and diagnostics utility for managing SNMP networked devices via a web interface.
CWE-434: Unrestricted Upload of File with Dangerous Type - CVE-2016-1524
An unauthenticated attacker on the network can upload arbitrary files to the server's root web directory, leading to data creation and arbitrary code execution with SYSTEM privileges. An authenticated attacker on the network can access any file on the server host.
The CERT/CC is currently unaware of a practical solution to this problem and recommends the following workaround.
Thanks to Pedro Ribeiro (email@example.com) of Agile Information Security for reporting this vulnerability.
This document was written by Joel Land.