{"id":"CVE-2020-10924","published":"2020-07-28T17:10:36Z","modified":"2024-08-04T11:14:15Z","title":"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR…","vendor":"NETGEAR","product":"R6700","tier":"core","eol":null,"affectedVersions":[{"vendor":"NETGEAR","product":"R6700","versions":["V1.0.4.84_10.0.58"]}],"description":{"text":"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643.","provenance":"source","from":"CVE.org"},"summary":{"text":"The NETGEAR R6700 router (firmware V1.0.4.84_10.0.58) contains a stack-based buffer overflow in its UPnP service, which listens on TCP port 5000 by default, caused by missing length validation of user-supplied data before it is copied into a fixed-length buffer. A network-adjacent attacker can bypass the existing authentication mechanism, which is otherwise required, and exploit the flaw to execute code as root, with no user interaction needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:52Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.87343,"percentile":0.99753,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-704/","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-3330","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-3330","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Netgear R6700v3 Unauthenticated LAN Admin Password Reset","module":"auxiliary/admin/http/netgear_r6700_pass_reset","type":"auxiliary","disclosureDate":"2020-06-15","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb"}],"first":{"date":"2020-06-15","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-06-15","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb","provenance":"source"},{"date":"2020-07-28","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-10924","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9975"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}