Netgear R6700 1.0.4.84_10.0.58 Service Port 5000 UPnP Message authentication bypass

Summaryinfo

A vulnerability was found in Netgear R6700 1.0.4.84_10.0.58. It has been rated as critical. The impacted element is an unknown function of the component Service Port 5000. The manipulation as part of UPnP Message leads to authentication bypass. This vulnerability is traded as CVE-2020-10923. Access to the local network is required for this attack to succeed. There is no exploit available.

Detailsinfo

A vulnerability was found in Netgear R6700 1.0.4.84_10.0.58 (Wireless LAN Software) and classified as critical. This issue affects an unknown function of the component Service Port 5000. The manipulation as part of a UPnP Message leads to a authentication bypass vulnerability. Using CWE to declare the problem leads to CWE-305. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.

The weakness was shared 07/28/2020 (Website). The advisory is shared at zerodayinitiative.com. The identification of this vulnerability is CVE-2020-10923 since 03/24/2020. The attack needs to approached within the local network. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/29/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-159093, VDB-159092, VDB-159091 and VDB-159090 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• R6700

Version

• 1.0.4.84_10.0.58

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion