Netgear R6700 up to 1.0.4.84_10.0.58 String Table File Upload format string

Summaryinfo

A vulnerability, which was classified as critical, has been found in Netgear R6700 up to 1.0.4.84_10.0.58. This affects an unknown part of the component String Table File Upload Handler. This manipulation causes format string. This vulnerability appears as CVE-2020-15634. The attacker needs to be present on the local network. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Netgear R6700 up to 1.0.4.84_10.0.58 (Wireless LAN Software). It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component String Table File Upload Handler. The manipulation with an unknown input leads to a format string vulnerability. The CWE definition for the vulnerability is CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9755.

The weakness was presented 08/20/2020 (Website). It is possible to read the advisory at kb.netgear.com. This vulnerability is known as CVE-2020-15634 since 07/07/2020. The attack can only be done within the local network. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.0.4.84_10.0.58 eliminates this vulnerability.

See VDB-160064 for similar entry. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• R6700

Version

• 1.0.4.84_10.0.0
• 1.0.4.84_10.0.1
• 1.0.4.84_10.0.2
• 1.0.4.84_10.0.3
• 1.0.4.84_10.0.4
• 1.0.4.84_10.0.5
• 1.0.4.84_10.0.6
• 1.0.4.84_10.0.7
• 1.0.4.84_10.0.8
• 1.0.4.84_10.0.9
• 1.0.4.84_10.0.10
• 1.0.4.84_10.0.11
• 1.0.4.84_10.0.12
• 1.0.4.84_10.0.13
• 1.0.4.84_10.0.14
• 1.0.4.84_10.0.15
• 1.0.4.84_10.0.16
• 1.0.4.84_10.0.17
• 1.0.4.84_10.0.18
• 1.0.4.84_10.0.19
• 1.0.4.84_10.0.20
• 1.0.4.84_10.0.21
• 1.0.4.84_10.0.22
• 1.0.4.84_10.0.23
• 1.0.4.84_10.0.24
• 1.0.4.84_10.0.25
• 1.0.4.84_10.0.26
• 1.0.4.84_10.0.27
• 1.0.4.84_10.0.28
• 1.0.4.84_10.0.29
• 1.0.4.84_10.0.30
• 1.0.4.84_10.0.31
• 1.0.4.84_10.0.32
• 1.0.4.84_10.0.33
• 1.0.4.84_10.0.34
• 1.0.4.84_10.0.35
• 1.0.4.84_10.0.36
• 1.0.4.84_10.0.37
• 1.0.4.84_10.0.38
• 1.0.4.84_10.0.39
• 1.0.4.84_10.0.40
• 1.0.4.84_10.0.41
• 1.0.4.84_10.0.42
• 1.0.4.84_10.0.43
• 1.0.4.84_10.0.44
• 1.0.4.84_10.0.45
• 1.0.4.84_10.0.46
• 1.0.4.84_10.0.47
• 1.0.4.84_10.0.48
• 1.0.4.84_10.0.49
• 1.0.4.84_10.0.50
• 1.0.4.84_10.0.51
• 1.0.4.84_10.0.52
• 1.0.4.84_10.0.53
• 1.0.4.84_10.0.54
• 1.0.4.84_10.0.55
• 1.0.4.84_10.0.56
• 1.0.4.84_10.0.57
• 1.0.4.84_10.0.58

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion