CVE-2020-15636

CWE-121 — Stack-based Buffer Overflow3 documents3 sources
Severity
9.8CRITICAL
EPSS
19.8%
top 4.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Netgear R6700 FirmwareNetgear Multiple Routers
Timeline
PublishedAug 20
Latest updateMay 24

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the check_ra service. A crafted raePolicyVersion in a RAE_Policy.json file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in t…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDnetgear/r6700_firmware< 1.0.4.98
▶CVEListV5netgear/multiple_routers1.0.4.84_10.0.58

🔴Vulnerability Details

2
GHSA
GHSA-4789-cr7h-xx57: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS↗2022-05-24
▶
CVEList
CVE-2020-15636: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS↗2020-08-19
▶