Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear d3600 firmwarebefore 1.0.0.67
• netgear d6000 firmwarebefore 1.0.0.67
• netgear d7800 firmwarebefore 1.0.1.30
• netgear ex2700 firmwarebefore 1.0.1.28
• netgear r6100 firmwarebefore 1.0.1.20
• netgear r7500 firmwarebefore 1.0.0.118
• netgear r7500 firmwarebefore 1.0.3.24
• netgear r7800 firmwarebefore 1.0.2.40
• netgear r900 firmwarebefore 1.0.2.52
• netgear wn2000rpt firmwarebefore 1.0.1.20
• netgear wn3000rp firmwarebefore 1.0.2.50
• netgear wn3100rp firmwarebefore 1.0.0.56
• netgear wndr3700 firmwarebefore 1.0.2.96
• netgear wndr4300 firmwarebefore 1.0.2.98
• netgear wndr4300 firmwarebefore 1.0.0.50
• netgear wndr4500 firmwarebefore 1.0.0.50

Other highest-scoring records for the same primary product.

• CVE-2020-35799Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
  39Monitor
• CVE-2018-21137Certain NETGEAR devices are affected by a hardcoded password.
  39Monitor
• CVE-2019-20730Certain NETGEAR devices are affected by SQL injection.
  39Monitor
• CVE-2017-18762Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
  36Monitor
• CVE-2021-45641Certain NETGEAR devices are affected by incorrect configuration of security settings.
  35Monitor
• CVE-2018-21224Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.