CVE-2020-28373 : upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitr

upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44.

Published 2020-11-09 22:15:13

Updated 2020-11-23 18:41:35

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionExecute code

Products affected by CVE-2020-28373

Netgear » R6400 Firmware » Version: 1.0.1.62 1.0.41
cpe:2.3:o:netgear:r6400_firmware:1.0.1.62_1.0.41:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6400 » Version: N/A
Netgear » R7300dst Firmware » Version: 1.0.0.74
cpe:2.3:o:netgear:r7300dst_firmware:1.0.0.74:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7300dst » Version: N/A
Netgear » R7900 Firmware » Version: 1.0.4.30
cpe:2.3:o:netgear:r7900_firmware:1.0.4.30:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7900 » Version: N/A
Netgear » R8000 Firmware » Version: 1.0.4.62
cpe:2.3:o:netgear:r8000_firmware:1.0.4.62:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8000 » Version: N/A
Netgear » R6250 Firmware » Version: 1.0.4.44
cpe:2.3:o:netgear:r6250_firmware:1.0.4.44:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6250 » Version: N/A
Netgear » R8300 Firmware » Version: 1.0.2.136
cpe:2.3:o:netgear:r8300_firmware:1.0.2.136:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8300 » Version: N/A
Netgear » R8500 Firmware » Version: 1.0.2.136
cpe:2.3:o:netgear:r8500_firmware:1.0.2.136:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8500 » Version: N/A
Netgear » R7000p Firmware » Version: 1.3.2.126 10.1.66
cpe:2.3:o:netgear:r7000p_firmware:1.3.2.126_10.1.66:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7000p » Version: N/A
Netgear » Rax80 Firmware » Version: 1.0.3.102
cpe:2.3:o:netgear:rax80_firmware:1.0.3.102:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rax80 » Version: N/A
Netgear » R7850 Firmware » Version: 1.0.5.64
cpe:2.3:o:netgear:r7850_firmware:1.0.5.64:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7850 » Version: N/A
Netgear » Xr300 Firmware » Version: 1.0.3.50 10.3.36
cpe:2.3:o:netgear:xr300_firmware:1.0.3.50_10.3.36:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Xr300 » Version: N/A
Netgear » Rax20 Firmware » Version: 1.0.2.64
cpe:2.3:o:netgear:rax20_firmware:1.0.2.64:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rax20 » Version: N/A
Netgear » R6400v2 Firmware » Version: 1.0.4.102 10.0.75
cpe:2.3:o:netgear:r6400v2_firmware:1.0.4.102_10.0.75:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6400v2 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-28373

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-28373

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.3	HIGH	AV:A/AC:L/Au:N/C:C/I:C/A:C	6.5	10.0	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-28373

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-28373

https://github.com/cpeggg/Netgear-upnpd-poc

GitHub - cpeggg/Netgear-upnpd-poc: Netgear upnpd ssdp request process stack overflow poc
Broken Link;Third Party Advisory

Jump to

Vulnerability Details : CVE-2020-28373

Products affected by CVE-2020-28373

Exploit prediction scoring system (EPSS) score for CVE-2020-28373

CVSS scores for CVE-2020-28373

CWE ids for CVE-2020-28373

References for CVE-2020-28373