Stack-based buffer overflow in NETGEAR products - #VU64814

Vulnerability identifier: #VU64814

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

XR1000
WNDR3400v3
R6400
XR300
R8000
R6400v2
R7850
R7000
R6900P
R7000P
RS400
DC112A
R6700v3
RAXE450
RAXE500
MK83
MR80
MS80
MK62
MR60
MS60

Install updates from vendor's website.

XR1000 - update to 1.0.0.64
DC112A - update to 1.0.0.64
WNDR3400v3 - update to 1.0.1.44
R6400 - update to 1.0.1.76
XR300 - update to 1.0.3.68
R8000 - update to 1.0.4.76
R6400v2 - update to 1.0.4.122
R6700v3 - update to 1.0.4.122
R7850 - update to 1.0.5.76
RAXE450 - update to 1.0.8.70
RAXE500 - update to 1.0.8.70
R7000 - update to 1.0.11.130
MK83 - update to 1.1.6.14
MR80 - update to 1.1.6.14
MS80 - update to 1.1.6.14
MK62 - update to 1.1.6.122
MR60 - update to 1.1.6.122
MS60 - update to 1.1.6.122
R6900P - update to 1.3.3.148
R7000P - update to 1.3.3.148
RS400 - update to 1.5.1.86

• https://kb.netgear.com/000065043/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2021-0187

• Stack-based buffer overflow in NETGEAR Routers and WiFi Systems