SSD Advisory – Netgear ReadyNAS Surveillance Unauthenticated Remote Command Execution

[Maor Shwartz <maors () beyondsecurity com>]

SSD Advisory – Netgear ReadyNAS Surveillance Unauthenticated Remote Command
Execution

Full report: https://blogs.securiteam.com/index.php/archives/3409
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerability summary
The following advisory describes an Unauthenticated Remote Command
Execution vulnerability found in Netgear ReadyNAS Surveillance.

Netgear ReadyNAS Surveillance – Small businesses and corporate branch
offices require a secure way to protect physical assets, but often lack the
security expertise or big budget that most solutions require. With these
challenges in mind, NETGEAR introduces ReadyNAS Surveillance, easy-to-use
network video recording (NVR) software that installs directly to a ReadyNAS
storage device. Add a set of cameras to a Power over Ethernet ProSafe
switch and your surveillance network is up and running in no time.

Credit
An independent security researcher, Kacper Szurek, has reported this
vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

Vendor response
Netgear was informed of the vulnerability on June 27, but while
acknowledging the receipt of the vulnerability information, refused to
respond to the technical claims, to give a fix timeline or coordinate an
advisory.

--
Thanks
Maor Shwartz
Beyond Security
GPG Key ID: 93CC36E2DE7FF514

Attachment: SSD Advisory – Netgear ReadyNAS Surveillance Unauthenticated Remote Command Execution – SecuriTeam Blogs.pdf
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/