CVE-2021-34991

published 2021-11-15

CVE-2021-34991: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers…

Priority P2 64 high 8.8 CVSS 3.1

AV A AC L PR N UI N S U C H I H A H

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. When parsing the uuid request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14110.

Affected

45 ranges · showing 25

Vendor	Product	Version range	Fixed in
netgear	cax80_firmware	< 2.1.3.5	2.1.3.5
netgear	d6220_firmware	< 1.0.0.76	1.0.0.76
netgear	d6400_firmware	< 1.0.0.108	1.0.0.108
netgear	d7000v2_firmware	< 1.0.0.76	1.0.0.76
netgear	dc112a_firmware	< 1.0.0.62	1.0.0.62
netgear	dgn2200v4_firmware	< 1.0.0.126	1.0.0.126
netgear	ex3700_firmware	< 1.0.0.94	1.0.0.94
netgear	ex3800_firmware	< 1.0.0.94	1.0.0.94
netgear	ex6120_firmware	< 1.0.0.66	1.0.0.66
netgear	ex6130_firmware	< 1.0.0.66	1.0.0.66
netgear	r6400_firmware	< 1.0.1.76	1.0.1.76
netgear	r6400v2	—	—
netgear	r6400v2_firmware	< 1.0.4.120	1.0.4.120
netgear	r6700v3_firmware	< 1.0.4.120	1.0.4.120
netgear	r6900p_firmware	< 1.3.3.142	1.3.3.142
netgear	r7000_firmware	< 1.0.11.128	1.0.11.128
netgear	r7000p_firmware	< 1.3.3.142	1.3.3.142
netgear	r7100lg_firmware	< 1.0.0.72	1.0.0.72
netgear	r7850_firmware	< 1.0.5.76	1.0.5.76
netgear	r7900p_firmware	< 1.4.2.84	1.4.2.84
netgear	r7960p_firmware	< 1.4.2.84	1.4.2.84
netgear	r8000_firmware	< 1.0.4.76	1.0.4.76
netgear	r8000p_firmware	< 1.4.2.84	1.4.2.84
netgear	r8300_firmware	< 1.0.2.156	1.0.2.156
netgear	r8500_firmware	< 1.0.2.156	1.0.2.156

Detection & IOCs extracted from sources · hover to see the quote

port 5000/TCP↗

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT UPnP UUID Password Change Exploit Attempt Inbound - R6700V3 PoC Gadgets (CVE-2021-34991)"; flow:established,to_server; http.method; content:"SUBSCRIBE"; http.header_names; to_lowercase; content:"|0d 0a|uuid|0d 0a|"; fast_pattern; http.request_body; content:"|d0|j|06 00|"; content:"|81 01 00|"; distance:10; within:10; reference:url,kb.netgear.com/000064361/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0168; reference:url,blog.grimm-co.com/2021/11/seamlessly-discovering-netgear.html; reference:cve,2021-34991; classtype:attempted-admin; sid:2034494; rev:2; metadata:attack_target Server, created_at 2021_11_18, cve CVE_2021_34991, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2024_04_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT UPnP UUID Password Change Exploit Attempt Inbound - XR300 PoC Gadgets (CVE-2021-34991)"; flow:established,to_server; http.method; content:"SUBSCRIBE"; http.header_names; to_lowercase; content:"|0d 0a|uuid|0d 0a|"; fast_pattern; http.request_body; content:"|b7 05 00|"; content:"|e0 e7 02|"; distance:10; within:10; reference:url,kb.netgear.com/000064361/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0168; reference:url,blog.grimm-co.com/2021/11/seamlessly-discovering-netgear.html; reference:cve,2021-34991; classtype:attempted-admin; sid:2034493; rev:3; metadata:attack_target Server, created_at 2021_11_18, cve CVE_2021_34991, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2024_04_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

bytes

|d0|j|06 00| ... |81 01 00| (R6700V3 ROP gadgets in HTTP request body)

bytes

|b7 05 00| ... |e0 e7 02| (XR300 ROP gadgets in HTTP request body)

bytes

|0d 0a|uuid|0d 0a| (UUID header in HTTP SUBSCRIBE request)

• → Look for HTTP SUBSCRIBE method requests containing a 'uuid' header — this is the attack vector for the UPnP stack-based buffer overflow via the uuid request header.
• → The exploit targets the UPnP service listening on TCP port 5000; monitor for unauthenticated SUBSCRIBE requests to this port from network-adjacent hosts. ↗
• → Device-specific ROP gadget byte sequences differ per target model (R6700V3 vs XR300); use the respective byte signatures in the HTTP request body to fingerprint which device variant is being targeted.
• → No authentication is required to trigger this vulnerability; any unauthenticated SUBSCRIBE request with an oversized uuid header to the UPnP service should be treated as suspicious. ↗

• · The two Snort/ET rules cover only R6700V3 and XR300 PoC gadget byte patterns; other affected NETGEAR models (e.g., R6400v2) may use different ROP gadget offsets and will not be detected by these specific byte signatures. ↗
• · The ET rules are classified as 'deployment Perimeter, deployment Internal', meaning they should be deployed at both network perimeter and internal segments, as the attacker only needs to be network-adjacent (not necessarily internet-facing). ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v3.0 8.8 HIGH CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 8.3 HIGH AV:A/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121 CWE-787