CVSS: 8.8EPSS: 0%CPEs: 38EXPL: 0CVE-2020-27866 – NETGEAR Multiple Routers mini_httpd Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-27866
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. • https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers https://www.zerodayinitiative.com/advisories/ZDI-20-1451 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 8.8EPSS: 0%CPEs: 71EXPL: 0CVE-2020-27861 – NETGEAR Orbi UA_Parser Host Name Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-27861
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. • https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems https://www.zerodayinitiative.com/advisories/ZDI-20-1430 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-5641
https://notcve.org/view.php?id=CVE-2020-5641
Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authentication of administrators and the product's settings may be changed without the user's intention or consent via unspecified vectors. Una vulnerabilidad de tipo cross-site request forgery (CSRF) en el firmware GS108E versiones v3 2.06.10 y anteriores, permite a atacantes remotos secuestrar la autenticación de los administradores y la configuración del producto puede cambiarse sin la intención o el consentimiento del usuario por medio de vectores no especificados • https://jvn.jp/en/jp/JVN27806339/index.html https://kb.netgear.com/000062496/GS108Ev3-Firmware-Version-2-06-14 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 26EXPL: 0CVE-2020-28373
https://notcve.org/view.php?id=CVE-2020-28373
upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44. upnpd en determinados dispositivos NETGEAR permite a atacantes remotos (LAN) ejecutar código arbitrario por medio de un desbordamiento del búfer en la región stack de la memoria. Esto afecta a R6400v2 versión V1.0.4.102_10.0.75, R6400 versión V1.0.1.62_1.0.41, R7000P versión V1.3.2.126_10.1.66, XR300 versión V1.0.3.50_10.3.36, R8000 versión V1.0.4.62, R8300 versión V1.0.2. 136, R8500 versión V1.0.2.136, R7300DST versión V1.0.0.74, R7850 versión V1.0.5.64, R7900 versión V1.0.4.30, RAX20 versión V1.0.2.64, RAX80 versión V1.0.3.102 y R6250 versión V1.0.4. 44 • https://github.com/cpeggg/Netgear-upnpd-poc • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 9%CPEs: 2EXPL: 3CVE-2020-28041
https://notcve.org/view.php?id=CVE-2020-28041
The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs because the ALG takes action based on an IP packet with an initial REGISTER substring in the TCP data, and the correct intranet IP address in the subsequent Via header, without properly considering that connection progress and fragmentation affect the meaning of the packet data. La implementación de SIP ALG en dispositivos NETGEAR Nighthawk R7000 versión 1.0.9.64_10.2.64, permite a atacantes remotos comunicarse con servicios TCP y UDP arbitrarios en la máquina de la intranet de la víctima, si la víctima visita un sitio web controlado por un atacante con un navegador moderno, también conocido como NAT Slipstreaming . Esto ocurre porque el ALG toma acción en base a un paquete IP con una subcadena REGISTER inicial en los datos TCP y la dirección IP de intranet correcta en el encabezado Via subsiguiente, sin considerar apropiadamente que el progreso de la conexión y la fragmentación afectan el significado de los datos del paquete • https://github.com/samyk/slipstream https://news.ycombinator.com/item?id=24956616 https://news.ycombinator.com/item?id=24958281 https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0024 https://samy.pl/slipstream • CWE-276: Incorrect Default Permissions •