cbcvebase.
CVE-2021-31802
published 2021-04-26

CVE-2021-31802: NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists…

PriorityP262high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EXPLOIT
EPSS
14.18%
96.1th percentile
NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length value is trusted during a backup.cgi file upload. The attacker must add a \n before the Content-Length header.

Affected

1 ranges
VendorProductVersion rangeFixed in
netgearr7000_firmware<= 1.0.11.116—

Detection & IOCsextracted from sources · hover to see the quote

path/genie.cgi?backup.cgi↗
filenamebackup.cgi↗
  • →Look for HTTP requests to /genie.cgi?backup.cgi containing a newline character (\n) injected immediately before the Content-Length header, which is the trigger condition for the heap overflow. ↗
  • →Monitor for unexpected telnet service (port 23) activation on NETGEAR R7000 devices, as successful exploitation enables the telnet daemon to provide a root/admin BusyBox shell. ↗
  • →Alert on unauthenticated HTTP POST/multipart file-upload requests to backup.cgi originating from the local network segment targeting NETGEAR R7000 firmware 1.0.11.116. ↗
  • ·Exploitation requires LAN-adjacent network access; the vulnerability is not directly exploitable from the internet unless the router's management interface is exposed externally. ↗
  • ·The Metasploit module targets only firmware version 1.0.11.116; detections or mitigations scoped to this specific version string may miss other potentially affected firmware variants. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.3HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.