Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU50953
Risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-27239
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the upnpd service. A remote unauthenticated attacker on the local network can use a specially crafted MX header field in an SSDP message, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsD6220: before 1.0.0.68
XR300: before 1.0.3.56
WNR3500Lv2: before 1.2.0.66
WNDR3400v3: before 1.0.1.38
RS400: before 1.5.0.68_hotfix
RBS850: before 3.2.17.12
RBS750: before 3.2.17.12
RBS40V: before 2.6.2.4
RBR850: before 3.2.17.12
RBR750: before 3.2.17.12
RAX80: before 1.0.3.102
RAX75: before 1.0.3.102
RAX200: before 1.0.2.88
R8500: before 1.0.2.144
R8300: before 1.0.2.144
R8000P: before 1.4.1.68
R8000: before 1.0.4.68
R7960P: before 1.4.1.68
R7900P: before 1.4.1.68
R7900: before 1.0.4.38
R7850: before 1.0.5.68
R7100LG: before 1.0.0.64
R7000P: before 1.3.2.132
R7000: before 1.0.11.116
R6900P: before 1.3.2.132
R6700v3: before 1.0.4.102
R6400v2: before 1.0.4.102
R6400: before 1.0.1.68
R6300v2: before 1.0.4.50
R6250: before 1.0.4.48
EX7500: before 1.0.0.72
EX7000: before 1.0.1.94
DC112A: before 1.0.0.54
D8500: before 1.0.3.60
D6400: before 1.0.0.102
D7000v2: before 1.0.0.66
External linkshttp://www.zerodayinitiative.com/advisories/ZDI-21-206/
http://kb.netgear.com/000062820/Security-Advisory-for-Stack-based-Buffer-Overflow-Remote-Code-Execu...
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.