This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR…
NETGEAR · R6700
The NETGEAR R6700 router (firmware V1.0.4.84_10.0.58) contains a stack-based buffer overflow in its UPnP service, which listens on TCP port 5000 by default, caused by missing length validation of user-supplied data before it is copied into a fixed-length buffer. A network-adjacent attacker can bypass the existing authentication mechanism, which is otherwise required, and exploit the flaw to execute code as root, with no user interaction needed.
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (Metasploit) was available 43 days before disclosure.
- Public exploit codeMetasploit43 days before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.