Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear d3600 firmwarebefore 1.0.0.67
• netgear d6000 firmwarebefore 1.0.0.67
• netgear d6100 firmwarebefore 1.0.0.56
• netgear d7800 firmwarebefore 1.0.1.30
• netgear r6100 firmwarebefore 1.0.1.20
• netgear r7500 firmwarebefore 1.0.3.24
• netgear r7500 firmwarebefore 1.0.0.118
• netgear r9000 firmwarebefore 1.0.2.52
• netgear wndr3700 firmwarebefore 1.0.2.96
• netgear wndr4300 firmwarebefore 1.0.0.50
• netgear wndr4300 firmwarebefore 1.0.2.98
• netgear wndr4500 firmwarebefore 1.0.0.50
• netgear wnr2000 firmwarebefore 1.0.0.62

Other highest-scoring records for the same primary product.

• CVE-2017-6862NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypKEV
  83Now
• CVE-2023-50089A Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70.
  40Plan
• CVE-2018-21222Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
  35Monitor
• CVE-2018-21220Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
  35Monitor
• CVE-2018-21219Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
  35Monitor
• CVE-2022-46423An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router.
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.