CVE-2020-27867 : This vulnerability allows network-adjacent attackers to execute arbitrary code o

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. When parsing the funjsq_access_token parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11653.

Published 2021-02-12 00:15:13

Updated 2021-03-26 19:37:26

Source Zero Day Initiative

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2020-27867

Netgear » R6700 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6700 » Version: V2
Netgear » R6900 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:r6900_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6900 » Version: V2
Netgear » R6220 Firmware
Versions before (<) 1.1.0.104
cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6220 » Version: N/A
Netgear » R6020 Firmware
Versions before (<) 1.0.0.48
cpe:2.3:o:netgear:r6020_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6020 » Version: N/A
Netgear » R6080 Firmware
Versions before (<) 1.0.0.48
cpe:2.3:o:netgear:r6080_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6080 » Version: N/A
Netgear » R6120 Firmware
Versions before (<) 1.0.0.76
cpe:2.3:o:netgear:r6120_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6120 » Version: N/A
Netgear » R6800 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6800 » Version: N/A
Netgear » R6230 Firmware
Versions before (<) 1.1.0.104
cpe:2.3:o:netgear:r6230_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6230 » Version: N/A
Netgear » R6260 Firmware
Versions before (<) 1.1.0.78
cpe:2.3:o:netgear:r6260_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6260 » Version: N/A
Netgear » R6850 Firmware
Versions before (<) 1.1.0.78
cpe:2.3:o:netgear:r6850_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6850 » Version: N/A
Netgear » R6350 Firmware
Versions before (<) 1.1.0.78
cpe:2.3:o:netgear:r6350_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6350 » Version: N/A
Netgear » R6330 Firmware
Versions before (<) 1.1.0.78
cpe:2.3:o:netgear:r6330_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6330 » Version: N/A
Netgear » R7200 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:r7200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7200 » Version: N/A
Netgear » R7350 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:r7350_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7350 » Version: N/A
Netgear » R7400 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:r7400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7400 » Version: N/A
Netgear » R7450 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:r7450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7450 » Version: N/A
Netgear » Ac2100 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:ac2100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ac2100 » Version: N/A
Netgear » Ac2400 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:ac2400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ac2400 » Version: N/A
Netgear » Ac2600 Firmware
Versions before (<) 1.2.0.76
cpe:2.3:o:netgear:ac2600_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ac2600 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-27867

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 24 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-27867

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.7	HIGH	AV:A/AC:L/Au:S/C:C/I:C/A:C	5.1	10.0	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.8	MEDIUM	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	Zero Day Initiative
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.8	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.9	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-27867

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Assigned by:
- nvd@nist.gov (Secondary)
- zdi-disclosures@trendmicro.com (Primary)

References for CVE-2020-27867

https://kb.netgear.com/000062641/Security-Advisory-for-Password-Recovery-Vulnerabilities-on-Some-Routers

Security Advisory for Password Recovery Vulnerabilities on Some Routers | Answer | NETGEAR Support
Vendor Advisory

CVEs referencing this url
https://www.zerodayinitiative.com/advisories/ZDI-20-1423/

ZDI-20-1423 | Zero Day Initiative
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-27867

Products affected by CVE-2020-27867

Exploit prediction scoring system (EPSS) score for CVE-2020-27867

CVSS scores for CVE-2020-27867

CWE ids for CVE-2020-27867

References for CVE-2020-27867