{"uuid": "98cb8fe7-517f-4e2d-9b02-7f5cda43ef44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"armle\", \"author\": [\"colorlight2019\", \"SSD Disclosure\", \"Grant Willcox (tekwizz123)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a heap buffer overflow in the genie.cgi?backup.cgi\\n          page of Netgear R7000 routers running firmware version 1.0.11.116.\\n          Successful exploitation results in unauthenticated attackers gaining\\n          code execution as the root user.\\n\\n          The exploit utilizes these privileges to enable the telnet server\\n          which allows attackers to connect to the target and execute commands\\n          as the admin user from within a BusyBox shell. Users can connect to\\n          this telnet server by running the command \\\"telnet *target IP*\\\".\", \"disclosure_date\": \"2021-04-21\", \"fullname\": \"auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"Netgear R7000 backup.cgi Heap Overflow RCE\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\"], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/netgear_r7000_backup_cgi_heap_overflow_rce\", \"references\": [\"URL-https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/\", \"CVE-2021-31802\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:48.538183Z"}