Netgear EX8000 Command Injection Vulnerability in switch_status Function

A command injection vulnerability has been identified in the Netgear EX8000 router, specifically in version 1.0.0.126. The issue arises within the switch_status function, allowing for unauthorized command execution.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

The vulnerability can be reproduced by sending a crafted request that exploits the switch_status function. This can be done using a variety of tools that allow for HTTP request manipulation, such as curl or Postman. The specific details of the request needed to trigger the vulnerability are not provided, but the command injection can be observed in the accompanying video demonstration.