Vulnerabilities > CVE-2020-28373 - Out-of-bounds Write vulnerability in Netgear products

CVSS 8.8 - HIGH

Attack vector

ADJACENT_NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

low complexity

netgear

CWE-787

NVD

Published: 2020-11-09

Updated: 2024-11-21

Summary

upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44.

Vulnerable Configurations

Part	Description	Count
OS	Netgear Netgear R6400V2 Firmware 1.0.4.102_10.0.75 Netgear R6400 Firmware 1.0.1.62_1.0.41 Netgear R7000P Firmware 1.3.2.126_10.1.66 Netgear Xr300 Firmware 1.0.3.50_10.3.36 Netgear R8000 Firmware 1.0.4.62 Netgear R8300 Firmware 1.0.2.136 Netgear R8500 Firmware 1.0.2.136 Netgear R7300Dst Firmware 1.0.0.74 Netgear R7850 Firmware 1.0.5.64 Netgear R7900 Firmware 1.0.4.30 Netgear Rax20 Firmware 1.0.2.64 Netgear Rax80 Firmware 1.0.3.102 Netgear R6250 Firmware 1.0.4.44	13
Hardware	Netgear Netgear R6400V2 - Netgear R6400 - Netgear R7000P - Netgear Xr300 - Netgear R8000 - Netgear R8300 - Netgear R8500 - Netgear R7300Dst - Netgear R7850 - Netgear R7900 - Netgear Rax20 - Netgear Rax80 - Netgear R6250 -	13

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References