CVE-2022-27643: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers…

PriorityP268high8.8CVSS 3.1

AVAACLPRNUINSUCHIHAH

EPSS

25.11%

97.7th percentile

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15692.

Affected

29 ranges· showing 25

Vendor	Product	Version range	Fixed in
netgear	d6220_firmware	< 1.0.0.80	1.0.0.80
netgear	d6400_firmware	< 1.0.0.114	1.0.0.114
netgear	d7000v2_firmware	< 1.0.0.80	1.0.0.80
netgear	dc112a_firmware	< 1.0.0.64	1.0.0.64
netgear	ex3700_firmware	< 1.0.0.96	1.0.0.96
netgear	ex3800_firmware	< 1.0.0.96	1.0.0.96
netgear	ex6120_firmware	< 1.0.0.68	1.0.0.68
netgear	ex6130_firmware	< 1.0.0.48	1.0.0.48
netgear	r6400_firmware	< 1.0.1.78	1.0.1.78
netgear	r6400_firmware	< 1.0.4.126	1.0.4.126
netgear	r6700_firmware	< 1.0.4.126	1.0.4.126
netgear	r6700v3	—	—
netgear	r6900p_firmware	< 1.3.3.148	1.3.3.148
netgear	r7000_firmware	< 1.0.11.134	1.0.11.134
netgear	r7000p_firmware	< 1.3.3.148	1.3.3.148
netgear	r7100lg_firmware	< 1.0.0.76	1.0.0.76
netgear	r7850_firmware	< 1.0.5.84	1.0.5.84
netgear	r7900p_firmware	< 1.4.3.88	1.4.3.88
netgear	r7960p_firmware	< 1.4.3.88	1.4.3.88
netgear	r8000_firmware	< 1.0.4.84	1.0.4.84
netgear	r8000p_firmware	< 1.4.3.88	1.4.3.88
netgear	r8500_firmware	< 1.0.2.158	1.0.2.158
netgear	rax200_firmware	< 1.0.6.138	1.0.6.138
netgear	rax75_firmware	< 1.0.6.138	1.0.6.138
netgear	rax80_firmware	< 1.0.6.138	1.0.6.138

Detection & IOCsextracted from sources · hover to see the quote

snort

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT NetGear R6700v3 upnpd Buffer Overflow Inbound (CVE-2022-27643)"; flow:established,to_server; http.method; content:"POST"; http.request_header; header_lowercase; content:"soapaction|3a|"; startswith; content:"urn:NETGEARROUTER:service:ParentalControl:1#Authenticate"; fast_pattern; nocase; http.request_body; content:""; nocase; pcre:"/^[^/Ri"; reference:url,blog.relyze.com/2022/03/cve-2022-27643-netgear-r6700v3-upnpd.html; reference:cve,2022-27643; classtype:attempted-admin; sid:2035717; rev:3; metadata:attack_target Networking_Equipment, created_at 2022_04_03, cve CVE_2022_27643, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, updated_at 2024_04_28;)

→Exploit traffic arrives as an HTTP POST request targeting the UPnP daemon (upnpd); detect by matching the SOAPAction header value 'urn:NETGEARROUTER:service:ParentalControl:1#Authenticate' (case-insensitive) on inbound traffic to network/HTTP servers.
→The vulnerability is exploitable without authentication from network-adjacent attackers; no prior session or credentials are needed, so any unauthenticated POST with the matching SOAPAction header should be treated as suspicious.
→The overflow occurs during parsing of the SOAPAction header — monitor for abnormally long SOAPAction header values in HTTP requests directed at NETGEAR R6700v3 devices.
→Successful exploitation results in code execution as root; correlate UPnP daemon (upnpd) process anomalies or unexpected child processes on NETGEAR R6700v3 routers as post-exploitation indicators.

·The Snort/Suricata rule (sid:2035717) targets traffic flowing TO [$HOME_NET,$HTTP_SERVERS]; ensure UPnP-exposed router management interfaces are included in these variables, otherwise the rule will not fire on perimeter-facing deployments.
·The rule is scoped to network-adjacent attack vectors; perimeter deployment alone may be insufficient if the attacker is already on the LAN segment. Internal deployment of the rule is also recommended.
·The affected version is specifically NETGEAR R6700v3 1.0.4.120_10.0.91; confirm firmware version before applying detection rules to avoid false positives on other NETGEAR models.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv3.08.8HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.