Netgear R6700 1.0.4.84_10.0.58 File Download certificate validation

Summaryinfo

A vulnerability identified as problematic has been detected in Netgear R6700 1.0.4.84_10.0.58. This impacts an unknown function of the component File Download. This manipulation causes certificate validation. This vulnerability is handled as CVE-2020-10925. The attack can only be done within the local network. There is not any exploit available.

Detailsinfo

A vulnerability was found in Netgear R6700 1.0.4.84_10.0.58 (Wireless LAN Software). It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the component File Download. The manipulation with an unknown input leads to a certificate validation vulnerability. The CWE definition for the vulnerability is CWE-295. The product does not validate, or incorrectly validates, a certificate. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9647.

The weakness was released 07/28/2020 (Website). It is possible to read the advisory at zerodayinitiative.com. This vulnerability is known as CVE-2020-10925 since 03/24/2020. The exploitation appears to be difficult. The attack can only be initiated within the local network. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/29/2020). The attack technique deployed by this issue is T1587.003 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-159095, VDB-159094, VDB-159093 and VDB-159092. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• R6700

Version

• 1.0.4.84_10.0.58

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion