Lucene search

ZdiCVE-2020-10923

HistoryJul 28, 2020 - 6:15 p.m.

CVE-2020-10923

2020-07-2818:15:13

CWE-305

zdi

web.nvd.nist.gov

In Wild

cve-2020-10923

netgear

r6700

authentication bypass

vulnerability

upnp

tcp port 5000

arbitrary code execution

zdi-can-9642

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.

Affected configurations

Nvd

Vulners

Node

netgearr6700_firmwareMatch1.0.4.84_10.0.58

AND

netgearr6700Match-

VendorProductVersionCPE
netgearr6700_firmware1.0.4.84_10.0.58cpe:2.3:o:netgear:r6700_firmware:1.0.4.84_10.0.58:*:*:*:*:*:*:*
netgearr6700-cpe:2.3:h:netgear:r6700:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgear	r6700_firmware	1.0.4.84_10.0.58	cpe:2.3:o:netgear:r6700_firmware:1.0.4.84_10.0.58:::::::*
netgear	r6700	-	cpe:2.3:h:netgear:r6700:-:::::::*

CNA Affected

[
  {
    "product": "R6700",
    "vendor": "NETGEAR",
    "versions": [
      {
        "status": "affected",
        "version": "V1.0.4.84_10.0.58"
      }
    ]
  }
]

References

www.zerodayinitiative.com/advisories/ZDI-20-703/

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

Related for CVE-2020-10923