CVE-2013-10060

The vulnerability is located in the pppoe.cgi endpoint, where the pppoe_username parameter is not properly filtered before being passed to a system call. An attacker with valid credentials can submit crafted input containing additional system commands that will be executed by the router with operating system privileges. According to the vulnerability description, the effects of exploitation may persist after device restart unless the original configuration is restored.

An attacker can gain full control of the device by executing arbitrary commands in the router's operating system, which includes modifying configuration, intercepting network traffic, and maintaining persistent access.

Apply patches available from the manufacturer according to the references. If an update is not available, it is recommended to restrict access to the router's administrative interface to trusted IP addresses only and disable remote access to the management panel.

Netgear DGN2200B with firmware version 1.0.0.36 and earlier