Certain NETGEAR devices are affected by a buffer overflow.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear d6200 firmwarebefore 1.1.00.24
• netgear d7000 firmwarebefore 1.0.1.52
• netgear jnr1010 firmwarebefore 1.1.0.44
• netgear jr6150 firmwarebefore 1.0.1.12
• netgear jwnr2010 firmwarebefore 1.1.0.44
• netgear pr2000 firmwarebefore 1.0.0.20
• netgear r6020 firmwarebefore 1.0.0.26
• netgear r6050 firmwarebefore 1.0.1.12
• netgear r6080 firmwarebefore 1.0.0.26
• netgear r6120 firmwarebefore 1.0.0.36
• netgear r6220 firmwarebefore 1.1.0.60
• netgear r6700 firmwarebefore 1.2.0.12
• netgear r6800 firmwarebefore 1.2.0.12
• netgear r6900 firmwarebefore 1.2.0.12
• netgear wndr3700 firmwarebefore 1.1.0.50
• netgear wnr1000 firmwarebefore 1.1.0.44
• netgear wnr2020 firmwarebefore 1.1.0.44
• netgear wnr2050 firmwarebefore 1.1.0.44

Other highest-scoring records for the same primary product.

• CVE-2020-26908Certain NETGEAR devices are affected by authentication bypass.
  40Plan
• CVE-2021-45551Certain NETGEAR devices are affected by command injection by an authenticated user.
  35Monitor
• CVE-2020-26912Certain NETGEAR devices are affected by CSRF.
  35Monitor
• CVE-2020-26911Certain NETGEAR devices are affected by lack of access control at the function level.
  35Monitor
• CVE-2017-18727Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
  35Monitor
• CVE-2017-18725Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.