CVE-2020-27861 : This vulnerability allows network-adjacent attackers to execute arbitrary code o

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076.

Published 2021-02-12 00:15:13

Updated 2021-03-23 18:54:23

Source Zero Day Initiative

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2020-27861

Netgear » Ex6200 Firmware
Versions before (<) 1.0.1.82
cpe:2.3:o:netgear:ex6200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6200 » Version: V2
Netgear » Ex8000 Firmware
Versions before (<) 1.0.1.224
cpe:2.3:o:netgear:ex8000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex8000 » Version: N/A
Netgear » Rbr20 Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbr20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr20 » Version: N/A
Netgear » Rbs20 Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbs20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs20 » Version: N/A
Netgear » Rbr40 Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbr40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr40 » Version: N/A
Netgear » Rbs40 Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbs40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs40 » Version: N/A
Netgear » Rbr50 Firmware
Versions before (<) 2.6.1.40
cpe:2.3:o:netgear:rbr50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr50 » Version: N/A
Netgear » Rbs50 Firmware
Versions before (<) 2.6.1.40
cpe:2.3:o:netgear:rbs50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs50 » Version: N/A
Netgear » Rbk50 Firmware
Versions before (<) 2.6.1.40
cpe:2.3:o:netgear:rbk50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk50 » Version: N/A
Netgear » Ex7700 Firmware
Versions before (<) 1.0.0.210
cpe:2.3:o:netgear:ex7700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex7700 » Version: N/A
Netgear » Rbk12 Firmware
Versions before (<) 2.6.1.44
cpe:2.3:o:netgear:rbk12_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk12 » Version: N/A
Netgear » Rbk13 Firmware
Versions before (<) 2.6.1.44
cpe:2.3:o:netgear:rbk13_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk13 » Version: N/A
Netgear » Rbk14 Firmware
Versions before (<) 2.6.1.44
cpe:2.3:o:netgear:rbk14_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk14 » Version: N/A
Netgear » Rbk15 Firmware
Versions before (<) 2.6.1.44
cpe:2.3:o:netgear:rbk15_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk15 » Version: N/A
Netgear » Rbr10 Firmware
Versions before (<) 2.6.1.44
cpe:2.3:o:netgear:rbr10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr10 » Version: N/A
Netgear » Rbs10 Firmware
Versions before (<) 2.6.1.44
cpe:2.3:o:netgear:rbs10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs10 » Version: N/A
Netgear » Cbr40 Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:cbr40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Cbr40 » Version: N/A
Netgear » Cbk40 Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:cbk40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Cbk40 » Version: N/A
Netgear » Cbk43 Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:cbk43_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Cbk43 » Version: N/A
Netgear » Rbk20w Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk20w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk20w » Version: N/A
Netgear » Rbk23w Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk23w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk23w » Version: N/A
Netgear » Rbk20 Router Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk20_router_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk20 » Version: N/A
Netgear » Rbk20 Satellite Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbk20_satellite_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk20 » Version: N/A
Netgear » Rbk22 Router Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk22_router_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk22 » Version: N/A
Netgear » Rbk22 Satellite Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbk22_satellite_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk22 » Version: N/A
Netgear » Rbk23 Router Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk23_router_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk23 » Version: N/A
Netgear » Rbk23 Satellite Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbk23_satellite_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk23 » Version: N/A
Netgear » Rbk30 Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk30_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk30 » Version: N/A
Netgear » Rbk33 Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk33_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk33 » Version: N/A
Netgear » Rbk40 Router Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk40_router_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk40 » Version: N/A
Netgear » Rbk40 Satellite Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbk40_satellite_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk40 » Version: N/A
Netgear » Rbk43 Router Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk43_router_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk43 » Version: N/A
Netgear » Rbk43 Satellite Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbk43_satellite_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk43 » Version: N/A
Netgear » Rbk43s Router Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk43s_router_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk43s » Version: N/A
Netgear » Rbk43s Satellite Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbk43s_satellite_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk43s » Version: N/A
Netgear » Rbk44 Router Firmware
Versions before (<) 2.6.1.36
cpe:2.3:o:netgear:rbk44_router_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk44 » Version: N/A
Netgear » Rbk44 Satellite Firmware
Versions before (<) 2.6.1.38
cpe:2.3:o:netgear:rbk44_satellite_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk44 » Version: N/A
Netgear » Rbk50v Firmware
Versions before (<) 2.6.1.40
cpe:2.3:o:netgear:rbk50v_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk50v » Version: N/A
Netgear » Rbk52w Firmware
Versions before (<) 2.6.1.40
cpe:2.3:o:netgear:rbk52w_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk52w » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-27861

EPSS FAQ

0.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-27861

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.3	HIGH	AV:A/AC:L/Au:N/C:C/I:C/A:C	6.5	10.0	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	Zero Day Initiative
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-27861

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Assigned by:
- nvd@nist.gov (Secondary)
- zdi-disclosures@trendmicro.com (Primary)

References for CVE-2020-27861

https://www.zerodayinitiative.com/advisories/ZDI-20-1430/

ZDI-20-1430 | Zero Day Initiative
Third Party Advisory;VDB Entry
https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems

Security Advisory for Unauthenticated Command Injection Vulnerability on Some Extenders and Orbi WiFi Systems, PSV-2020-0301 | Answer | NETGEAR Support
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-27861

Products affected by CVE-2020-27861

Exploit prediction scoring system (EPSS) score for CVE-2020-27861

CVSS scores for CVE-2020-27861

CWE ids for CVE-2020-27861

References for CVE-2020-27861