Login Request a demo
High severity · published Mar 29, 2021
CVE-2021-27239
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upnpd service, which listens on UDP port 1900 by default. A crafted MX header field in an SSDP message can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11851.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
D6220 Firmware · Netgear
before 1.0.0.68 · source: NVD
DF
D6400 Firmware · Netgear
before 1.0.0.102 · source: NVD
DF
D7000 Firmware · Netgear
before 1.0.0.66 · source: NVD
DF
D8500 Firmware · Netgear
before 1.0.3.60 · source: NVD
DF
Dc112a Firmware · Netgear
before 1.0.0.54 · source: NVD
EF
Ex7000 Firmware · Netgear
before 1.0.1.94 · source: NVD
EF
Ex7500 Firmware · Netgear
before 1.0.0.72 · source: NVD
RF
R6250 Firmware · Netgear
before 1.0.4.48 · source: NVD
RF
R6300 Firmware · Netgear
before 1.0.4.50 · source: NVD
RF
R6400 Firmware · Netgear
before 1.0.1.68; before 1.0.4.102 · source: NVD
RF
R6700 Firmware · Netgear
before 1.0.4.102 · source: NVD
RF
R6900p Firmware · Netgear
before 1.3.2.132 · source: NVD
Affected product
DF
D6220 Firmware
Netgear
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27239
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27239
Vendor Advisory
https://kb.netgear.com/000062820/Security-Advisory-for-Stack-based-Buffer-Overflow-Remote-Code-Execution-Vulnerability-on-Some-Routers-PSV-2020-0432
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-206/
More from D6220 Firmware
8.8
CVE-2016-6277
NETGEAR Multiple Routers Remote Code Execution Vulnerability
8.1
CVE-2017-5521
NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
9.8
CVE-2021-45638
Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker
9.8
CVE-2021-45610
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker
9.8
CVE-2021-45527
Certain NETGEAR devices are affected by a buffer overflow by an authenticated user