High severity · published Feb 12, 2021
CVE-2020-27861
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers
8.8
CVSS
2%
EPSS
No
On KEV
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cbk40 Firmware · Netgear
before 2.6.1.38 · source: NVD
CF
Cbk43 Firmware · Netgear
before 2.6.1.38 · source: NVD
CF
Cbr40 Firmware · Netgear
before 2.6.1.38 · source: NVD
EF
Ex6200 Firmware · Netgear
before 1.0.1.82 · source: NVD
EF
Ex7700 Firmware · Netgear
before 1.0.0.210 · source: NVD
EF
Ex8000 Firmware · Netgear
before 1.0.1.224 · source: NVD
RF
Rbk12 Firmware · Netgear
before 2.6.1.44 · source: NVD
RF
Rbk13 Firmware · Netgear
before 2.6.1.44 · source: NVD
RF
Rbk14 Firmware · Netgear
before 2.6.1.44 · source: NVD
RF
Rbk15 Firmware · Netgear
before 2.6.1.44 · source: NVD
RR
Rbk20 Router Firmware · Netgear
before 2.6.1.36 · source: NVD
RS
Rbk20 Satellite Firmware · Netgear
before 2.6.1.38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27861
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27861
Vendor Advisory
https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1430/
More from Cbk40 Firmware
9.8
CVE-2020-35795
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker
9.4
CVE-2020-35800
Certain NETGEAR devices are affected by incorrect configuration of security settings
7.5
CVE-2024-28340
An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive…
5.4
CVE-2024-28339
An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information…