Stack-based buffer overflow in NETGEAR products - CVE-2021-27239

Vulnerability identifier: #VU50953

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-27239

CWE-ID: CWE-121

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the upnpd service. A remote unauthenticated attacker on the local network can use a specially crafted MX header field in an SSDP message, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

DC112A
D7000v2
EX7500
EX7000
RAX200
RAX80
RAX75
R6700v3
R7900P
R7960P
R8000P
RBS40V
RBR850
RBR750
RBS750
RBS850
R7100LG
D6220
D6400
WNDR3400v3
R6400
R8300
R8500
XR300
D8500
R7900
R6250
R6300v2
R8000
R6400v2
R7850
R7000
WNR3500Lv2
R6900P
R7000P
RS400

Install updates from vendor's website.

DC112A - update to 1.0.0.54
R7100LG - update to 1.0.0.64
D7000v2 - update to 1.0.0.66
D6220 - update to 1.0.0.68
EX7500 - update to 1.0.0.72
D6400 - update to 1.0.0.102
WNDR3400v3 - update to 1.0.1.38
R6400 - update to 1.0.1.68
EX7000 - update to 1.0.1.94
RAX200 - update to 1.0.2.88
R8300 - update to 1.0.2.144
R8500 - update to 1.0.2.144
XR300 - update to 1.0.3.56
D8500 - update to 1.0.3.60
RAX80 - update to 1.0.3.102
RAX75 - update to 1.0.3.102
R7900 - update to 1.0.4.38
R6250 - update to 1.0.4.48
R6300v2 - update to 1.0.4.50
R8000 - update to 1.0.4.68
R6400v2 - update to 1.0.4.102
R6700v3 - update to 1.0.4.102
R7850 - update to 1.0.5.68
R7000 - update to 1.0.11.116
WNR3500Lv2 - update to 1.2.0.66
R6900P - update to 1.3.2.132
R7000P - update to 1.3.2.132
R7900P - update to 1.4.1.68
R7960P - update to 1.4.1.68
R8000P - update to 1.4.1.68
RS400 - update to 1.5.0.68_hotfix
RBS40V - update to 2.6.2.4
RBR850 - update to 3.2.17.12
RBR750 - update to 3.2.17.12
RBS750 - update to 3.2.17.12
RBS850 - update to 3.2.17.12

• https://www.zerodayinitiative.com/advisories/ZDI-21-206/
• https://kb.netgear.com/000062820/Security-Advisory-for-Stack-based-Buffer-Overflow-Remote-Code-Execu...

• Remote code execution in Multiple NETGEAR Routers