CVE-2024-35518
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Netgear EX6120 WiFi extenders by injecting malicious commands into the wan_dns1_pri parameter of the genie_fix2.cgi script. Attackers can gain full control of affected devices, potentially compromising network security. All users running vulnerable firmware versions are affected.
💻 Affected Systems
- Netgear EX6120
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to persistent backdoor installation, network pivoting to attack other devices, credential theft, and participation in botnets.
Likely Case
Remote code execution allowing attackers to modify device settings, intercept network traffic, or use the device as a foothold for further attacks.
If Mitigated
Limited impact if device is behind strict firewall rules, not internet-facing, and network segmentation prevents lateral movement.
🎯 Exploit Status
The vulnerability is in a CGI script that processes user input without proper sanitization. Attackers can craft HTTP requests with command injection payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check Netgear support site for firmware updates
2. If update available, download and install via web interface
3. Reboot device after update
4. Verify firmware version is no longer v1.0.0.68
🔧 Temporary Workarounds
Network Isolation
allPlace device behind firewall with strict inbound rules
Access Restriction
allDisable remote management and restrict web interface access
🧯 If You Can't Patch
- Replace device with non-vulnerable model or newer firmware
- Segment network to isolate EX6120 from critical systems
🔍 How to Verify
Check if Vulnerable:
Check firmware version in web interface under Advanced > Administration > Router UpgradeCheck Version:
curl -s http://device-ip/currentsetting.htm | grep FirmwareVerify Fix Applied:
Confirm firmware version is newer than v1.0.0.68📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to genie_fix2.cgi with shell metacharacters
- Unexpected command execution in system logs
Network Indicators:
- HTTP POST requests to /genie_fix2.cgi with suspicious parameters
- Outbound connections from device to unknown IPs
SIEM Query:
source="netgear_logs" AND uri="/genie_fix2.cgi" AND (param="wan_dns1_pri" AND value MATCHES "[;&|`$()]+")