Details of VAR-202203-1670

ID

VAR-202203-1670

CVE

CVE-2022-27646

TITLE

Stack-based buffer overflow vulnerability in multiple Netgear products

Trust: 0.8

sources: JVNDB: JVNDB-2022-022072

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15879. R6400 firmware, R6700 firmware, R6900P A stack-based buffer overflow vulnerability exists in multiple Netgear products, including firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.34

sources: NVD: CVE-2022-27646 // JVNDB: JVNDB-2022-022072 // ZDI: ZDI-22-523 // VULMON: CVE-2022-27646

AFFECTED PRODUCTS

vendor:	netgear	model:	lbr20	scope:	lt	version:	2.7.4.2	Trust: 1.0
vendor:	netgear	model:	rbs10	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	rbs40	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	r6700	scope:	lt	version:	1.0.4.126	Trust: 1.0
vendor:	netgear	model:	r6400	scope:	lt	version:	1.0.4.126	Trust: 1.0
vendor:	netgear	model:	r7960p	scope:	lt	version:	1.4.3.88	Trust: 1.0
vendor:	netgear	model:	cbr40	scope:	lt	version:	2.5.0.28	Trust: 1.0
vendor:	netgear	model:	rbr50	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	r8000p	scope:	lt	version:	1.4.3.88	Trust: 1.0
vendor:	netgear	model:	rax75	scope:	lt	version:	1.0.6.138	Trust: 1.0
vendor:	netgear	model:	r7850	scope:	lt	version:	1.0.5.84	Trust: 1.0
vendor:	netgear	model:	rbr40	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	rs400	scope:	lt	version:	1.5.1.86	Trust: 1.0
vendor:	netgear	model:	rbs20	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	r7000p	scope:	lt	version:	1.3.3.148	Trust: 1.0
vendor:	netgear	model:	rbr20	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	r7000	scope:	lt	version:	1.0.11.134	Trust: 1.0
vendor:	netgear	model:	r6900p	scope:	lt	version:	1.3.3.148	Trust: 1.0
vendor:	netgear	model:	lbr1020	scope:	lt	version:	2.7.4.2	Trust: 1.0
vendor:	netgear	model:	rbr10	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	r8000	scope:	lt	version:	1.0.4.84	Trust: 1.0
vendor:	netgear	model:	rax80	scope:	lt	version:	1.0.6.138	Trust: 1.0
vendor:	netgear	model:	rax200	scope:	lt	version:	1.0.6.138	Trust: 1.0
vendor:	netgear	model:	rbs50	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	ネットギア	model:	rbr20	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rs400	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6400	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7000	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	lbr1020	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8000	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax200	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	lbr20	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8000p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	cbr40	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6900p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax75	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbr40	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbr50	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7960p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6700	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax80	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rbr10	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7850	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7000p	scope:	-	version:	-	Trust: 0.8
vendor:	netgear	model:	r6700v3	scope:	-	version:	-	Trust: 0.7

sources: ZDI: ZDI-22-523 // JVNDB: JVNDB-2022-022072 // NVD: CVE-2022-27646

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com:	CVE-2022-27646
value:	HIGH
Trust: 1.0
nvd@nist.gov:	CVE-2022-27646
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-27646
value:	HIGH
Trust: 0.8
ZDI:	CVE-2022-27646
value:	HIGH
Trust: 0.7
CNNVD:	CNNVD-202203-2060
value:	HIGH
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2022-27646
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.1
impactScore:	5.9
version:	3.0
Trust: 1.0
nvd@nist.gov:	CVE-2022-27646
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2022-27646
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2022-27646
baseSeverity:	HIGH
baseScore:	8.0
vectorString:	AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.1
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-22-523 // JVNDB: JVNDB-2022-022072 // CNNVD: CNNVD-202203-2060 // NVD: CVE-2022-27646 // NVD: CVE-2022-27646

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	Stack-based buffer overflow (CWE-121) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-022072 // NVD: CVE-2022-27646

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202203-2060

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202203-2060

PATCH

title:	NETGEAR has issued an update to correct this vulnerability.	url:	https://kb.netgear.com/000064721/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0324	Trust: 0.7
title:	NETGEAR R6700v3 Remediation measures for authorization problem vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=231215	Trust: 0.6

sources: ZDI: ZDI-22-523 // CNNVD: CNNVD-202203-2060

EXTERNAL IDS

db:	NVD	id:	CVE-2022-27646	Trust: 4.0
db:	ZDI	id:	ZDI-22-523	Trust: 3.2
db:	JVNDB	id:	JVNDB-2022-022072	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-15879	Trust: 0.7
db:	CS-HELP	id:	SB2022032410	Trust: 0.6
db:	CNNVD	id:	CNNVD-202203-2060	Trust: 0.6
db:	VULMON	id:	CVE-2022-27646	Trust: 0.1

sources: ZDI: ZDI-22-523 // VULMON: CVE-2022-27646 // JVNDB: JVNDB-2022-022072 // CNNVD: CNNVD-202203-2060 // NVD: CVE-2022-27646

REFERENCES

url:	https://kb.netgear.com/000064721/security-advisory-for-multiple-vulnerabilities-on-multiple-products-psv-2021-0324	Trust: 3.2
url:	https://www.zerodayinitiative.com/advisories/zdi-22-523/	Trust: 3.2
url:	https://nvd.nist.gov/vuln/detail/cve-2022-27646	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-27646/	Trust: 0.6
url:	https://www.cybersecurity-help.cz/vdb/sb2022032410	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/121.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: ZDI: ZDI-22-523 // VULMON: CVE-2022-27646 // JVNDB: JVNDB-2022-022072 // CNNVD: CNNVD-202203-2060 // NVD: CVE-2022-27646

CREDITS

Kevin Denis (@0xmitsurugi) and Antide Petit (@xarkes_) from @Synacktiv

Trust: 1.3

sources: ZDI: ZDI-22-523 // CNNVD: CNNVD-202203-2060

SOURCES

db:	ZDI	id:	ZDI-22-523
db:	VULMON	id:	CVE-2022-27646
db:	JVNDB	id:	JVNDB-2022-022072
db:	CNNVD	id:	CNNVD-202203-2060
db:	NVD	id:	CVE-2022-27646

LAST UPDATE DATE

2024-08-14T13:42:55.949000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-22-523	date:	2022-03-23T00:00:00
db:	VULMON	id:	CVE-2022-27646	date:	2023-03-30T00:00:00
db:	JVNDB	id:	JVNDB-2022-022072	date:	2023-11-15T03:22:00
db:	CNNVD	id:	CNNVD-202203-2060	date:	2023-04-07T00:00:00
db:	NVD	id:	CVE-2022-27646	date:	2023-04-06T17:43:22.507

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-22-523	date:	2022-03-23T00:00:00
db:	VULMON	id:	CVE-2022-27646	date:	2023-03-29T00:00:00
db:	JVNDB	id:	JVNDB-2022-022072	date:	2023-11-15T00:00:00
db:	CNNVD	id:	CNNVD-202203-2060	date:	2022-03-23T00:00:00
db:	NVD	id:	CVE-2022-27646	date:	2023-03-29T19:15:08.707