Netgear WNR854T UPnP Command Injection Vulnerability Allowing Unauthenticated Remote Code Execution

A command injection vulnerability has been identified in the Netgear WNR854T router, specifically in version 1.5.2 for North America. The issue arises within the UPnP service, where the 'AddPortMapping' SOAP action improperly sanitizes the 'NewInternalClient' parameter before passing it to a system call. This vulnerability allows attackers to execute arbitrary commands on the router via the WANIPConn1 service.

Impact

Exploitation of this vulnerability leads to unauthorized execution of commands on the router, with the potential for full system compromise.

Reproduction

To reproduce this vulnerability, send a crafted SOAP request to the router's UPnP 'AddPortMapping' action. Include an oversized 'NewInternalClient' value that contains the desired command. The command injection can be verified by observing the execution of the injected command on the router.