CVE-2022-27646
NETGEAR R6700v3 circled Stack-based Buffer Overflow Remote Code Execution Vulnerability
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15879.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
*Credits:
Kevin Denis (@0xmitsurugi) and Antide Petit (@xarkes_) from @Synacktiv
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-03-22 CVE Reserved
- 2022-03-23 CVE Published
- 2024-08-03 CVE Updated
- 2024-09-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-121: Stack-based Buffer Overflow
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-22-523 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Netgear Search vendor "Netgear" | R6400 Firmware Search vendor "Netgear" for product "R6400 Firmware" | < 1.0.4.126 Search vendor "Netgear" for product "R6400 Firmware" and version " < 1.0.4.126" | - |
Affected
| in | Netgear Search vendor "Netgear" | R6400 Search vendor "Netgear" for product "R6400" | v2 Search vendor "Netgear" for product "R6400" and version "v2" | - |
Safe
|
| Netgear Search vendor "Netgear" | R6700 Firmware Search vendor "Netgear" for product "R6700 Firmware" | < 1.0.4.126 Search vendor "Netgear" for product "R6700 Firmware" and version " < 1.0.4.126" | - |
Affected
| in | Netgear Search vendor "Netgear" | R6700 Search vendor "Netgear" for product "R6700" | v3 Search vendor "Netgear" for product "R6700" and version "v3" | - |
Safe
|
| Netgear Search vendor "Netgear" | R6900p Firmware Search vendor "Netgear" for product "R6900p Firmware" | < 1.3.3.148 Search vendor "Netgear" for product "R6900p Firmware" and version " < 1.3.3.148" | - |
Affected
| in | Netgear Search vendor "Netgear" | R6900p Search vendor "Netgear" for product "R6900p" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | R7000 Firmware Search vendor "Netgear" for product "R7000 Firmware" | < 1.0.11.134 Search vendor "Netgear" for product "R7000 Firmware" and version " < 1.0.11.134" | - |
Affected
| in | Netgear Search vendor "Netgear" | R7000 Search vendor "Netgear" for product "R7000" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | R7000p Firmware Search vendor "Netgear" for product "R7000p Firmware" | < 1.3.3.148 Search vendor "Netgear" for product "R7000p Firmware" and version " < 1.3.3.148" | - |
Affected
| in | Netgear Search vendor "Netgear" | R7000p Search vendor "Netgear" for product "R7000p" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | R7850 Firmware Search vendor "Netgear" for product "R7850 Firmware" | < 1.0.5.84 Search vendor "Netgear" for product "R7850 Firmware" and version " < 1.0.5.84" | - |
Affected
| in | Netgear Search vendor "Netgear" | R7850 Search vendor "Netgear" for product "R7850" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | R7960p Firmware Search vendor "Netgear" for product "R7960p Firmware" | < 1.4.3.88 Search vendor "Netgear" for product "R7960p Firmware" and version " < 1.4.3.88" | - |
Affected
| in | Netgear Search vendor "Netgear" | R7960p Search vendor "Netgear" for product "R7960p" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | R8000 Firmware Search vendor "Netgear" for product "R8000 Firmware" | < 1.0.4.84 Search vendor "Netgear" for product "R8000 Firmware" and version " < 1.0.4.84" | - |
Affected
| in | Netgear Search vendor "Netgear" | R8000 Search vendor "Netgear" for product "R8000" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | R8000p Firmware Search vendor "Netgear" for product "R8000p Firmware" | < 1.4.3.88 Search vendor "Netgear" for product "R8000p Firmware" and version " < 1.4.3.88" | - |
Affected
| in | Netgear Search vendor "Netgear" | R8000p Search vendor "Netgear" for product "R8000p" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rax200 Firmware Search vendor "Netgear" for product "Rax200 Firmware" | < 1.0.6.138 Search vendor "Netgear" for product "Rax200 Firmware" and version " < 1.0.6.138" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rax200 Search vendor "Netgear" for product "Rax200" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rax75 Firmware Search vendor "Netgear" for product "Rax75 Firmware" | < 1.0.6.138 Search vendor "Netgear" for product "Rax75 Firmware" and version " < 1.0.6.138" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rax75 Search vendor "Netgear" for product "Rax75" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rax80 Firmware Search vendor "Netgear" for product "Rax80 Firmware" | < 1.0.6.138 Search vendor "Netgear" for product "Rax80 Firmware" and version " < 1.0.6.138" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rax80 Search vendor "Netgear" for product "Rax80" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rs400 Firmware Search vendor "Netgear" for product "Rs400 Firmware" | < 1.5.1.86 Search vendor "Netgear" for product "Rs400 Firmware" and version " < 1.5.1.86" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rs400 Search vendor "Netgear" for product "Rs400" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Cbr40 Firmware Search vendor "Netgear" for product "Cbr40 Firmware" | < 2.5.0.28 Search vendor "Netgear" for product "Cbr40 Firmware" and version " < 2.5.0.28" | - |
Affected
| in | Netgear Search vendor "Netgear" | Cbr40 Search vendor "Netgear" for product "Cbr40" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Lbr1020 Firmware Search vendor "Netgear" for product "Lbr1020 Firmware" | < 2.7.4.2 Search vendor "Netgear" for product "Lbr1020 Firmware" and version " < 2.7.4.2" | - |
Affected
| in | Netgear Search vendor "Netgear" | Lbr1020 Search vendor "Netgear" for product "Lbr1020" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Lbr20 Firmware Search vendor "Netgear" for product "Lbr20 Firmware" | < 2.7.4.2 Search vendor "Netgear" for product "Lbr20 Firmware" and version " < 2.7.4.2" | - |
Affected
| in | Netgear Search vendor "Netgear" | Lbr20 Search vendor "Netgear" for product "Lbr20" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbr10 Firmware Search vendor "Netgear" for product "Rbr10 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbr10 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbr10 Search vendor "Netgear" for product "Rbr10" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbr20 Firmware Search vendor "Netgear" for product "Rbr20 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbr20 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbr20 Search vendor "Netgear" for product "Rbr20" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbr40 Firmware Search vendor "Netgear" for product "Rbr40 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbr40 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbr40 Search vendor "Netgear" for product "Rbr40" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbr50 Firmware Search vendor "Netgear" for product "Rbr50 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbr50 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbr50 Search vendor "Netgear" for product "Rbr50" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbs10 Firmware Search vendor "Netgear" for product "Rbs10 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbs10 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbs10 Search vendor "Netgear" for product "Rbs10" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbs20 Firmware Search vendor "Netgear" for product "Rbs20 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbs20 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbs20 Search vendor "Netgear" for product "Rbs20" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbs40 Firmware Search vendor "Netgear" for product "Rbs40 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbs40 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbs40 Search vendor "Netgear" for product "Rbs40" | - | - |
Safe
|
| Netgear Search vendor "Netgear" | Rbs50 Firmware Search vendor "Netgear" for product "Rbs50 Firmware" | < 2.7.4.24 Search vendor "Netgear" for product "Rbs50 Firmware" and version " < 2.7.4.24" | - |
Affected
| in | Netgear Search vendor "Netgear" | Rbs50 Search vendor "Netgear" for product "Rbs50" | - | - |
Safe
|