ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Security Affairspublished ()ingested @securityaffairs

Netgear fixes code execution flaw in many SOHO devices

mediumExploit / PoCimportance 50CVE-2021-34991
Read the original
Tagscve-2021-34991exploit

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2021-34991
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. When parsing the uuid request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14110.

NVD description · AI analysis pending		8.86%
  • netgear ex3700 firmware
  • netgear ex3800 firmware
  • netgear ex6120 firmware
  • +1 more
—

Indicators of compromiseAll →

TypeIndicatorContext
ipv41.0.0.102lnerable Devices AC1450 – 1.0.0.36 D6220 – 1.0.0.72 D6300 – 1.0.0.102 D6400 – 1.0.0.104 D7000v2 – 1.0.0.66 D8500 – 1.0.3.60 DC112
ipv41.0.0.104C1450 – 1.0.0.36 D6220 – 1.0.0.72 D6300 – 1.0.0.102 D6400 – 1.0.0.104 D7000v2 – 1.0.0.66 D8500 – 1.0.3.60 DC112A – 1.0.0.56 DGN22
ipv41.0.0.1162 – 1.0.0.66 D8500 – 1.0.3.60 DC112A – 1.0.0.56 DGN2200v4 – 1.0.0.116 DGN2200M – 1.0.0.35 DGND3700v1 – 1.0.0.17 EX3700 – 1.0.0.88
ipv41.0.0.170.56 DGN2200v4 – 1.0.0.116 DGN2200M – 1.0.0.35 DGND3700v1 – 1.0.0.17 EX3700 – 1.0.0.88 EX3800 – 1.0.0.88 EX3920 – 1.0.0.88 EX600
ipv41.0.0.26– 1.2.32 WGT624v4 – 2.0.13 WNDR3300v1 – 1.0.45 WNDR3300v2 – 1.0.0.26 WNDR3400v1 – 1.0.0.52 WNDR3400v2 – 1.0.0.54 WNDR3400v3 – 1.
ipv41.0.0.351.0.3.60 DC112A – 1.0.0.56 DGN2200v4 – 1.0.0.116 DGN2200M – 1.0.0.35 DGND3700v1 – 1.0.0.17 EX3700 – 1.0.0.88 EX3800 – 1.0.0.88 E
ipv41.0.0.36dems, and WiFi range extenders: Vulnerable Devices AC1450 – 1.0.0.36 D6220 – 1.0.0.72 D6300 – 1.0.0.102 D6400 – 1.0.0.104 D7000v
ipv41.0.0.4– 1.0.0.54 EX7000 – 1.0.1.94 MVBR1210C – 1.2.0.35BM R4500 – 1.0.0.4 R6200 – 1.0.1.58 R6200v2 – 1.0.3.12 R6250 – 1.0.4.48 R6300
ipv41.0.0.40000 – 1.0.0.44 EX6100 – 1.0.2.28 EX6120 – 1.0.0.54 EX6130 – 1.0.0.40 EX6150 – 1.0.0.46 EX6920 – 1.0.0.54 EX7000 – 1.0.1.94 MVBR1
ipv41.0.0.4252 WNDR3400v2 – 1.0.0.54 WNDR3400v3 – 1.0.1.38 WNDR3700v3 – 1.0.0.42 WNDR4000 – 1.0.2.10 WNDR4500 – 1.0.1.46 WNDR4500v2 – 1.0.0.
ipv41.0.0.44700 – 1.0.0.88 EX3800 – 1.0.0.88 EX3920 – 1.0.0.88 EX6000 – 1.0.0.44 EX6100 – 1.0.2.28 EX6120 – 1.0.0.54 EX6130 – 1.0.0.40 EX615
ipv41.0.0.46100 – 1.0.2.28 EX6120 – 1.0.0.54 EX6130 – 1.0.0.40 EX6150 – 1.0.0.46 EX6920 – 1.0.0.54 EX7000 – 1.0.1.94 MVBR1210C – 1.2.0.35BM
ipv41.0.0.520.13 WNDR3300v1 – 1.0.45 WNDR3300v2 – 1.0.0.26 WNDR3400v1 – 1.0.0.52 WNDR3400v2 – 1.0.0.54 WNDR3400v3 – 1.0.1.38 WNDR3700v3 – 1.
ipv41.0.0.54920 – 1.0.0.88 EX6000 – 1.0.0.44 EX6100 – 1.0.2.28 EX6120 – 1.0.0.54 EX6130 – 1.0.0.40 EX6150 – 1.0.0.46 EX6920 – 1.0.0.54 EX700
ipv41.0.0.5600 – 1.0.0.104 D7000v2 – 1.0.0.66 D8500 – 1.0.3.60 DC112A – 1.0.0.56 DGN2200v4 – 1.0.0.116 DGN2200M – 1.0.0.35 DGND3700v1 – 1.0.
ipv41.0.0.6620 – 1.0.0.72 D6300 – 1.0.0.102 D6400 – 1.0.0.104 D7000v2 – 1.0.0.66 D8500 – 1.0.3.60 DC112A – 1.0.0.56 DGN2200v4 – 1.0.0.116 DG
ipv41.0.0.72nge extenders: Vulnerable Devices AC1450 – 1.0.0.36 D6220 – 1.0.0.72 D6300 – 1.0.0.102 D6400 – 1.0.0.104 D7000v2 – 1.0.0.66 D850
ipv41.0.0.741.3.2.134 R7000 – 1.0.11.123 R7000P – 1.3.2.134 R7300DST – 1.0.0.74 R7850 – 1.0.5.68 R7900 – 1.0.4.38 R8000 – 1.0.4.68 R8300 –
ipv41.0.0.88.0.0.116 DGN2200M – 1.0.0.35 DGND3700v1 – 1.0.0.17 EX3700 – 1.0.0.88 EX3800 – 1.0.0.88 EX3920 – 1.0.0.88 EX6000 – 1.0.0.44 EX610
ipv41.0.11.1230v3 – 1.0.4.118 R6900 – 1.0.2.16 R6900P – 1.3.2.134 R7000 – 1.0.11.123 R7000P – 1.3.2.134 R7300DST – 1.0.0.74 R7850 – 1.0.5.68 R79
ipv41.0.1.3826 WNDR3400v1 – 1.0.0.52 WNDR3400v2 – 1.0.0.54 WNDR3400v3 – 1.0.1.38 WNDR3700v3 – 1.0.0.42 WNDR4000 – 1.0.2.10 WNDR4500 – 1.0.1.
ipv41.0.1.460.1.38 WNDR3700v3 – 1.0.0.42 WNDR4000 – 1.0.2.10 WNDR4500 – 1.0.1.46 WNDR4500v2 – 1.0.0.72 WNR834Bv2 – 2.1.13 WNR1000v3 – 1.0.2.
ipv41.0.1.580 – 1.0.1.94 MVBR1210C – 1.2.0.35BM R4500 – 1.0.0.4 R6200 – 1.0.1.58 R6200v2 – 1.0.3.12 R6250 – 1.0.4.48 R6300 – 1.0.2.80 R6300v
ipv41.0.1.726250 – 1.0.4.48 R6300 – 1.0.2.80 R6300v2 – 1.0.4.52 R6400 – 1.0.1.72 R6400v2 – 1.0.4.106 R6700 – 1.0.2.16 R6700v3 – 1.0.4.118 R6
ipv41.0.1.94130 – 1.0.0.40 EX6150 – 1.0.0.46 EX6920 – 1.0.0.54 EX7000 – 1.0.1.94 MVBR1210C – 1.2.0.35BM R4500 – 1.0.0.4 R6200 – 1.0.1.58 R62
ipv41.0.2.100.54 WNDR3400v3 – 1.0.1.38 WNDR3700v3 – 1.0.0.42 WNDR4000 – 1.0.2.10 WNDR4500 – 1.0.1.46 WNDR4500v2 – 1.0.0.72 WNR834Bv2 – 2.1.1
ipv41.0.2.136R7900 – 1.0.4.38 R8000 – 1.0.4.68 R8300 – 1.0.2.144 R8500 – 1.0.2.136 RS400 – 1.5.0.68 WGR614v9 – 1.2.32 WGT624v4 – 2.0.13 WNDR33
ipv41.0.2.144R7850 – 1.0.5.68 R7900 – 1.0.4.38 R8000 – 1.0.4.68 R8300 – 1.0.2.144 R8500 – 1.0.2.136 RS400 – 1.5.0.68 WGR614v9 – 1.2.32 WGT624
ipv41.0.2.160v2 – 1.0.4.52 R6400 – 1.0.1.72 R6400v2 – 1.0.4.106 R6700 – 1.0.2.16 R6700v3 – 1.0.4.118 R6900 – 1.0.2.16 R6900P – 1.3.2.134 R70
ipv41.0.2.28800 – 1.0.0.88 EX3920 – 1.0.0.88 EX6000 – 1.0.0.44 EX6100 – 1.0.2.28 EX6120 – 1.0.0.54 EX6130 – 1.0.0.40 EX6150 – 1.0.0.46 EX692
ipv41.0.2.780.1.46 WNDR4500v2 – 1.0.0.72 WNR834Bv2 – 2.1.13 WNR1000v3 – 1.0.2.78 WNR2000v2 – 1.2.0.12 WNR3500 – 1.0.36NA WNR3500v2 – 1.2.2.2
ipv41.0.2.806200 – 1.0.1.58 R6200v2 – 1.0.3.12 R6250 – 1.0.4.48 R6300 – 1.0.2.80 R6300v2 – 1.0.4.52 R6400 – 1.0.1.72 R6400v2 – 1.0.4.106 R67
ipv41.0.3.1210C – 1.2.0.35BM R4500 – 1.0.0.4 R6200 – 1.0.1.58 R6200v2 – 1.0.3.12 R6250 – 1.0.4.48 R6300 – 1.0.2.80 R6300v2 – 1.0.4.52 R6400
ipv41.0.3.56.2.28NA WNR3500L – 1.2.2.48NA WNR3500Lv2 – 1.2.0.66 XR300 – 1.0.3.56 Netgear released security patches that fix the vulnerabilit
ipv41.0.3.6000 – 1.0.0.102 D6400 – 1.0.0.104 D7000v2 – 1.0.0.66 D8500 – 1.0.3.60 DC112A – 1.0.0.56 DGN2200v4 – 1.0.0.116 DGN2200M – 1.0.0.35
ipv41.0.4.10600 – 1.0.2.80 R6300v2 – 1.0.4.52 R6400 – 1.0.1.72 R6400v2 – 1.0.4.106 R6700 – 1.0.2.16 R6700v3 – 1.0.4.118 R6900 – 1.0.2.16 R6900
ipv41.0.4.1180 – 1.0.1.72 R6400v2 – 1.0.4.106 R6700 – 1.0.2.16 R6700v3 – 1.0.4.118 R6900 – 1.0.2.16 R6900P – 1.3.2.134 R7000 – 1.0.11.123 R700
ipv41.0.4.380P – 1.3.2.134 R7300DST – 1.0.0.74 R7850 – 1.0.5.68 R7900 – 1.0.4.38 R8000 – 1.0.4.68 R8300 – 1.0.2.144 R8500 – 1.0.2.136 RS400
ipv41.0.4.48R4500 – 1.0.0.4 R6200 – 1.0.1.58 R6200v2 – 1.0.3.12 R6250 – 1.0.4.48 R6300 – 1.0.2.80 R6300v2 – 1.0.4.52 R6400 – 1.0.1.72 R6400v
ipv41.0.4.5200v2 – 1.0.3.12 R6250 – 1.0.4.48 R6300 – 1.0.2.80 R6300v2 – 1.0.4.52 R6400 – 1.0.1.72 R6400v2 – 1.0.4.106 R6700 – 1.0.2.16 R6700
ipv41.0.4.68300DST – 1.0.0.74 R7850 – 1.0.5.68 R7900 – 1.0.4.38 R8000 – 1.0.4.68 R8300 – 1.0.2.144 R8500 – 1.0.2.136 RS400 – 1.5.0.68 WGR614
ipv41.0.5.68– 1.0.11.123 R7000P – 1.3.2.134 R7300DST – 1.0.0.74 R7850 – 1.0.5.68 R7900 – 1.0.4.38 R8000 – 1.0.4.68 R8300 – 1.0.2.144 R8500 –
ipv41.2.0.12.0.0.72 WNR834Bv2 – 2.1.13 WNR1000v3 – 1.0.2.78 WNR2000v2 – 1.2.0.12 WNR3500 – 1.0.36NA WNR3500v2 – 1.2.2.28NA WNR3500L – 1.2.2.
ipv41.2.0.35– 1.0.0.46 EX6920 – 1.0.0.54 EX7000 – 1.0.1.94 MVBR1210C – 1.2.0.35BM R4500 – 1.0.0.4 R6200 – 1.0.1.58 R6200v2 – 1.0.3.12 R6250
ipv41.2.0.66A WNR3500v2 – 1.2.2.28NA WNR3500L – 1.2.2.48NA WNR3500Lv2 – 1.2.0.66 XR300 – 1.0.3.56 Netgear released security patches that fix
ipv41.2.2.28.0.2.78 WNR2000v2 – 1.2.0.12 WNR3500 – 1.0.36NA WNR3500v2 – 1.2.2.28NA WNR3500L – 1.2.2.48NA WNR3500Lv2 – 1.2.0.66 XR300 – 1.0.3
ipv41.2.2.482.0.12 WNR3500 – 1.0.36NA WNR3500v2 – 1.2.2.28NA WNR3500L – 1.2.2.48NA WNR3500Lv2 – 1.2.0.66 XR300 – 1.0.3.56 Netgear released s
ipv41.3.2.13400 – 1.0.2.16 R6700v3 – 1.0.4.118 R6900 – 1.0.2.16 R6900P – 1.3.2.134 R7000 – 1.0.11.123 R7000P – 1.3.2.134 R7300DST – 1.0.0.74 R
ipv41.5.0.688000 – 1.0.4.68 R8300 – 1.0.2.144 R8500 – 1.0.2.136 RS400 – 1.5.0.68 WGR614v9 – 1.2.32 WGT624v4 – 2.0.13 WNDR3300v1 – 1.0.45 WND
Full article485 words · extracted from securityaffairs.com · click to collapse

Pierluigi Paganini November 17, 2021

Netgear addressed a code execution vulnerability, tracked as CVE-2021-34991, in its small office/home office (SOHO) devices.

Netgear addressed a pre-authentication buffer overflow issue in its small office/home office (SOHO) devices that can be exploited by an attacker on the local area network (LAN) to execute code remotely with root privileges.

The flaw, tracked as CVE-2021-34991 (CVSS score of 8.8), resides in the device’s Universal Plug-and-Play (UPnP) upnpd daemon functions related to the handling of “unauthenticated HTTP SUBSCRIBE and UNSUBSCRIBE requests from clients that wish to receive updates whenever the network’s UPnP configuration changes.”

The vulnerability was discovered by GRIMM researchers who also created a PoC exploit to compromise fully patched Netgear devices in the default configuration.

“This stack overflow is a traditional stack overflow that is not protected by any modern vulnerability mitigations.” reads the post published by GRIMM. “However, exploitation of this stack overflow is complicated by a few factors:

  1. Prior to overflowing the stack, the buffer with the user’s input is converted to lowercase. As a result, the exploit cannot use any gadgets which contain bytes with capital letters (ASCII 0x41-0x5A).
  2. The copy which overflows the stack is a string copy. As such, it will stop copying characters if it encounters a NULL character. Thus, the exploit cannot include gadgets with NULL bytes.

While the first limitation can be easily avoided by carefully choosing gadgets, the second limitation is much more difficult to bypass.”

Below is the list of impacted Netgear SOHO devices that includes routers, modems, and WiFi range extenders:

Vulnerable Devices
AC1450 – 1.0.0.36D6220 – 1.0.0.72D6300 – 1.0.0.102
D6400 – 1.0.0.104D7000v2 – 1.0.0.66D8500 – 1.0.3.60
DC112A – 1.0.0.56DGN2200v4 – 1.0.0.116DGN2200M – 1.0.0.35
DGND3700v1 – 1.0.0.17EX3700 – 1.0.0.88EX3800 – 1.0.0.88
EX3920 – 1.0.0.88EX6000 – 1.0.0.44EX6100 – 1.0.2.28
EX6120 – 1.0.0.54EX6130 – 1.0.0.40EX6150 – 1.0.0.46
EX6920 – 1.0.0.54EX7000 – 1.0.1.94MVBR1210C – 1.2.0.35BM
R4500 – 1.0.0.4R6200 – 1.0.1.58R6200v2 – 1.0.3.12
R6250 – 1.0.4.48R6300 – 1.0.2.80R6300v2 – 1.0.4.52
R6400 – 1.0.1.72R6400v2 – 1.0.4.106R6700 – 1.0.2.16
R6700v3 – 1.0.4.118R6900 – 1.0.2.16R6900P – 1.3.2.134
R7000 – 1.0.11.123R7000P – 1.3.2.134R7300DST – 1.0.0.74
R7850 – 1.0.5.68R7900 – 1.0.4.38R8000 – 1.0.4.68
R8300 – 1.0.2.144R8500 – 1.0.2.136RS400 – 1.5.0.68
WGR614v9 – 1.2.32WGT624v4 – 2.0.13WNDR3300v1 – 1.0.45
WNDR3300v2 – 1.0.0.26WNDR3400v1 – 1.0.0.52WNDR3400v2 – 1.0.0.54
WNDR3400v3 – 1.0.1.38WNDR3700v3 – 1.0.0.42WNDR4000 – 1.0.2.10
WNDR4500 – 1.0.1.46WNDR4500v2 – 1.0.0.72WNR834Bv2 – 2.1.13
WNR1000v3 – 1.0.2.78WNR2000v2 – 1.2.0.12WNR3500 – 1.0.36NA
WNR3500v2 – 1.2.2.28NAWNR3500L – 1.2.2.48NAWNR3500Lv2 – 1.2.0.66
XR300 – 1.0.3.56

Netgear released security patches that fix the vulnerability in multiple devices and announced that it is testing additional firmware fixes.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Netgear)

[adrotate banner=”5″]

[adrotate banner=”13″]

Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/124716/security/netgear-cve-2021-34991-soho-devices.html