Vulnerability Details : CVE-2020-10924

Public exploit exists!
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643.
Published 2020-07-28 18:15:14
Updated 2020-07-29 18:29:49
Source Zero Day Initiative
View at NVD,   CVE.org
Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2020-10924

EPSS FAQ
0.41%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-10924

  • Netgear R6700v3 Unauthenticated LAN Admin Password Reset
    Disclosure Date: 2020-06-15
    First seen: 2020-07-01
    auxiliary/admin/http/netgear_r6700_pass_reset
    This module targets ZDI-20-704 (aka CVE-2020-10924), a buffer overflow vulnerability in the UPNP daemon (/usr/sbin/upnpd), on Netgear R6700v3 routers running firmware versions from V1.0.2.62 up to but not including V1.0.4.94, to reset the password for the 'admin' user

CVSS scores for CVE-2020-10924

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
8.3
 HIGH AV:A/AC:L/Au:N/C:C/I:C/A:C
6.5
10.0
 NIST
8.8
 HIGH CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 Zero Day Initiative
8.8
 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 NIST

CWE ids for CVE-2020-10924

  • A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
    Assigned by: zdi-disclosures@trendmicro.com (Primary)

References for CVE-2020-10924

Products affected by CVE-2020-10924

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close