{"id":"CVE-2020-10923","published":"2020-07-28T17:10:35Z","modified":"2024-08-04T11:14:15Z","title":"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR…","vendor":"NETGEAR","product":"R6700","tier":"core","eol":null,"affectedVersions":[{"vendor":"NETGEAR","product":"R6700","versions":["V1.0.4.84_10.0.58"]}],"description":{"text":"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an authentication bypass in the UPnP service, which listens on TCP port 5000, on NETGEAR R6700 routers. An attacker with network-adjacent access can exploit it without authentication or user interaction by sending a crafted UPnP message, and it can be chained with other vulnerabilities to execute code as root.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:28Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.84676,"percentile":0.99705,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-305","name":"Authentication Bypass by Primary Weakness"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-703/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-3329","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3329","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Netgear R6700v3 Unauthenticated LAN Admin Password Reset","module":"auxiliary/admin/http/netgear_r6700_pass_reset","type":"auxiliary","disclosureDate":"2020-06-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb"}],"first":{"date":"2020-06-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-06-15","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb","provenance":"source"},{"date":"2020-07-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-10923","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":29.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}