Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear d3600 firmwarebefore 1.0.0.76
• netgear d6000 firmwarebefore 1.0.0.76
• netgear d6200 firmwarebefore 1.1.00.36
• netgear d7000 firmwarebefore 1.0.1.70
• netgear ex6200 firmwarebefore 1.0.1.78
• netgear ex7000 firmwarebefore 1.0.1.78
• netgear ex8000 firmwarebefore 1.0.1.186
• netgear jr6150 firmwarebefore 1.0.1.18
• netgear pr2000 firmwarebefore 1.0.0.28
• netgear r6020 firmwarebefore 1.0.0.42
• netgear r6050 firmwarebefore 1.0.1.18
• netgear r6080 firmwarebefore 1.0.0.42
• netgear r6120 firmwarebefore 1.0.0.46
• netgear r6220 firmwarebefore 1.1.0.80
• netgear r6260 firmwarebefore 1.1.0.64
• netgear r6300 firmwarebefore 1.0.4.34
• netgear r6700 firmwarebefore 1.0.2.6
• netgear r6700 firmwarebefore 1.2.0.36
• netgear r6800 firmwarebefore 1.2.0.36
• netgear r6900 firmwarebefore 1.2.0.36

Other highest-scoring records for the same primary product.

• CVE-2020-35799Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
  39Monitor
• CVE-2018-21137Certain NETGEAR devices are affected by a hardcoded password.
  39Monitor
• CVE-2019-20730Certain NETGEAR devices are affected by SQL injection.
  39Monitor
• CVE-2017-18762Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
  36Monitor
• CVE-2021-45641Certain NETGEAR devices are affected by incorrect configuration of security settings.
  35Monitor
• CVE-2018-21224Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.