Netgear R6700 1.0.4.84_10.0.58 Firmware Update code download

Summaryinfo

A vulnerability labeled as critical has been found in Netgear R6700 1.0.4.84_10.0.58. Affected is an unknown function of the component Firmware Update Handler. Such manipulation leads to code download. This vulnerability is uniquely identified as CVE-2020-10926. The attack can only be initiated within the local network. No exploit exists.

Detailsinfo

A vulnerability was found in Netgear R6700 1.0.4.84_10.0.58 (Wireless LAN Software). It has been rated as critical. Affected by this issue is an unknown part of the component Firmware Update Handler. The manipulation with an unknown input leads to a code download vulnerability. Using CWE to declare the problem leads to CWE-494. The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648.

The weakness was disclosed 07/28/2020 (Website). The advisory is shared for download at zerodayinitiative.com. This vulnerability is handled as CVE-2020-10926 since 03/24/2020. The attack needs to be done within the local network. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 07/29/2020). The MITRE ATT&CK project declares the attack technique as T1495.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-159096, VDB-159095, VDB-159094 and VDB-159093 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• R6700

Version

• 1.0.4.84_10.0.58

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion