CVE-2021-45608
published 2021-12-26CVE-2021-45608: Certain D-Link, Edimax, NETGEAR, TP-Link, Tenda, and Western Digital devices are affected by an integer overflow by an unauthenticated attacker. Remote code…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.51%
83.0th percentile
Certain D-Link, Edimax, NETGEAR, TP-Link, Tenda, and Western Digital devices are affected by an integer overflow by an unauthenticated attacker. Remote code execution from the WAN interface (TCP port 20005) cannot be ruled out; however, exploitability was judged to be of "rather significant complexity" but not "impossible." The overflow is in SoftwareBus_dispatchNormalEPMsgOut in the KCodes NetUSB kernel module. Affected NETGEAR devices are D7800 before 1.0.1.68, R6400v2 before 1.0.4.122, and R6700v3 before 1.0.4.122.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | d7800_firmware | < 1.0.1.68 | 1.0.1.68 |
| netgear | r6400v2_firmware | < 1.0.4.122 | 1.0.4.122 |
| netgear | r6700v3_firmware | < 1.0.4.122 | 1.0.4.122 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for inbound TCP connections to port 20005 (NetUSB service) from WAN-side interfaces, especially on router/embedded Linux devices running the KCodes NetUSB kernel module. ↗
- →Flag NetUSB TCP/20005 sessions where the attacker-supplied 4-byte size value is 0xffffffff or any value where (size + 0x11) overflows to a value <= 0x10, as this is the integer overflow exploitation primitive. ↗
- →Exploitation results in a kmalloc-32 slab allocation followed by an out-of-bounds write; kernel heap anomaly detection on embedded Linux devices should watch for unexpected kmalloc-32 slab corruption patterns. ↗
- ·The vulnerability is only reachable from the WAN if no firewall rules block TCP port 20005; devices with WAN-side firewall rules restricting this port are not directly exploitable from the internet. ↗
- ·Exploitation complexity is rated high; a working public exploit did not exist at time of disclosure, but cannot be ruled out in the future. ↗
- ·No in-the-wild exploitation was observed at time of public disclosure. ↗
- ·Affected NETGEAR devices requiring firmware updates are D7800 before 1.0.1.68, R6400v2 before 1.0.4.122, and R6700v3 before 1.0.4.122; end-of-life models are unlikely to receive patches. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Sentinelone
12 Months of Fighting Cybercrime & Defending Enterprises | SentinelLabs 2022 Review
blogs_sentinelone·2022-12-27·CVSS 8.8
[HIGH] 12 Months of Fighting Cybercrime & Defending Enterprises | SentinelLabs 2022 Review
2022 has been another eventful year for the SentinelLabs research team , with events in Ukraine dominating and directing a large portion of our research output. We also hosted the first ever LABScon , bringing together top tier researchers and thought leaders from across the industry, and found time to investigate a number of supply chain attacks , adversaries , macOS , Linux and Windows malware, and exploitable vulnerabilities .
We’ve seen a shift in ransomware TTPs with increasing use of hybrid and partial encryption and a greater focus from threat actors on stealing data for ransom as well as – and sometimes instead of – using file lockers.
All our research and threat intelligence posts can be found on the SentinelLabs home page , but for a quick recap of the year’s main highlights, t
Sentinelone
12 Months of Fighting Cybercrime & Defending Enterprises | SentinelLabs 2022 Review
blogs_sentinelone·2022-12-27·CVSS 8.8
[HIGH] 12 Months of Fighting Cybercrime & Defending Enterprises | SentinelLabs 2022 Review
2022 has been another eventful year for the SentinelLabs research team, with events in Ukraine dominating and directing a large portion of our research output. We also hosted the first ever LABScon, bringing together top tier researchers and thought leaders from across the industry, and found time to investigate a number of supply chain attacks, adversaries, macOS, Linux and Windows malware, and exploitable vulnerabilities.
We’ve seen a shift in ransomware TTPs with increasing use of hybrid and partial encryption and a greater focus from threat actors on stealing data for ransom as well as – and sometimes instead of – using file lockers.
All our research and threat intelligence posts can be found on the SentinelLabs home page, but for a quick recap of the year’s main highlights, take a s
Sentinelone
CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers
blogs_sentinelone·2022-01-11·CVSS 6.5
CVE-2021-45608 [MEDIUM] CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers
## Executive Summary
- SentinelLabs has discovered a high severity flaw in the KCodes NetUSB kernel module used by a large number of network device vendors and affecting millions of end user router devices.
- Attackers could remotely exploit this vulnerability to execute code in the kernel.
- SentinelLabs began the disclosure process on the 9th of September and the patch was sent to vendors on the 4th of October.
- At this time, SentinelOne has not discovered evidence of in-the-wild abuse.
## Introduction
As a number of my projects start, when I heard that Pwn2Own Mobile 2021 had been announced, I set about looking at one of the targets. Having not looked at the Netgear device when it appeared in the 2019 contest, I decided to give it a lookover.
While going through various paths throu
Sentinelone
CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers
blogs_sentinelone·2022-01-11·CVSS 6.5
CVE-2021-45608 [MEDIUM] CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers
## CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers
## Executive Summary
SentinelLabs has discovered a high severity flaw in the KCodes NetUSB kernel module used by a large number of network device vendors and affecting millions of end user router devices.
Attackers could remotely exploit this vulnerability to execute code in the kernel.
SentinelLabs began the disclosure process on the 9th of September and the patch was sent to vendors on the 4th of October.
At this time, SentinelOne has not discovered evidence of in-the-wild abuse.
## Introduction
As a number of my projects start, when I heard that Pwn2Own Mobile 2021 had been announced, I set about looking at one of the targets. Having not looked at the Netgear device when it appeared in the 2019 contest, I decided
https://kb.netgear.com/000064437/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0278https://www.sentinelone.com/labs/cve-2021-45608-netusb-rce-flaw-in-millions-of-end-user-routers/https://kb.netgear.com/000064437/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0278https://www.sentinelone.com/labs/cve-2021-45608-netusb-rce-flaw-in-millions-of-end-user-routers/
2021-12-26
Published