CVE-2022-27643 | ByteOS Network

Vulnerability Details :

CVE-2022-27643

Assigner-zdi

Assigner Org ID-99f1926a-a320-47d8-bbb5-42feb611262e

Published At-29 Mar, 2023 | 00:00

Updated At-18 Feb, 2025 | 17:49

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15692.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:zdi

Assigner Org ID:99f1926a-a320-47d8-bbb5-42feb611262e

Published At:29 Mar, 2023 | 00:00

Updated At:18 Feb, 2025 | 17:49

▼CVE Numbering Authority (CNA)

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15692.

Affected Products

Vendor

Product

Versions

Affected

1.0.4.120_10.0.91

Problem Types

Type	CWE ID	Description
CWE	CWE-120	CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Type: CWE

CWE ID: CWE-120

Description: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Metrics

Version	Base score	Base severity	Vector
3.0	8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Credits

Stephen Fewer of Relyze Software Limited (www.relyze.com)

References

Hyperlink	Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-519/	N/A
https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323	N/A

Hyperlink: https://www.zerodayinitiative.com/advisories/ZDI-22-519/

Resource: N/A

Hyperlink: https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-519/	x_transferred
https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323	x_transferred

Hyperlink: https://www.zerodayinitiative.com/advisories/ZDI-22-519/

Resource:

x_transferred

Hyperlink: https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:zdi-disclosures@trendmicro.com

Published At:29 Mar, 2023 | 19:15

Updated At:05 Apr, 2023 | 15:06

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15692.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.0	8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.0

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

>>r6400>>-

cpe:2.3:h:netgear:r6400:-:*:*:*:*:*:*:*

>>r6400_firmware>>Versions before 1.0.1.78(exclusive)

cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:*

>>r6400>>v2

cpe:2.3:h:netgear:r6400:v2:*:*:*:*:*:*:*

>>r6400_firmware>>Versions before 1.0.4.126(exclusive)

cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:*

>>r6700>>v3

cpe:2.3:h:netgear:r6700:v3:*:*:*:*:*:*:*

>>r6700_firmware>>Versions before 1.0.4.126(exclusive)

cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r6900p:-:*:*:*:*:*:*:*

>>r6900p_firmware>>Versions before 1.3.3.148(exclusive)

cpe:2.3:o:netgear:r6900p_firmware:*:*:*:*:*:*:*:*

>>r7000>>-

cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:*

>>r7000_firmware>>Versions before 1.0.11.134(exclusive)

cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:*

>>r7000p_firmware>>Versions before 1.3.3.148(exclusive)

cpe:2.3:o:netgear:r7000p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*

>>r7850_firmware>>Versions before 1.0.5.84(exclusive)

cpe:2.3:o:netgear:r7850_firmware:*:*:*:*:*:*:*:*

>>r7850>>-

cpe:2.3:h:netgear:r7850:-:*:*:*:*:*:*:*

>>r7900p_firmware>>Versions before 1.4.3.88(exclusive)

cpe:2.3:o:netgear:r7900p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r7900p:-:*:*:*:*:*:*:*

>>r7960p_firmware>>Versions before 1.4.3.88(exclusive)

cpe:2.3:o:netgear:r7960p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r7960p:-:*:*:*:*:*:*:*

>>r8000_firmware>>Versions before 1.0.4.84(exclusive)

cpe:2.3:o:netgear:r8000_firmware:*:*:*:*:*:*:*:*

>>r8000>>-

cpe:2.3:h:netgear:r8000:-:*:*:*:*:*:*:*

>>r8000p_firmware>>Versions before 1.4.3.88(exclusive)

cpe:2.3:o:netgear:r8000p_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r8000p:-:*:*:*:*:*:*:*

>>r8500_firmware>>Versions before 1.0.2.158(exclusive)

cpe:2.3:o:netgear:r8500_firmware:*:*:*:*:*:*:*:*

>>r8500>>-

cpe:2.3:h:netgear:r8500:-:*:*:*:*:*:*:*

>>rax200_firmware>>Versions before 1.0.6.138(exclusive)

cpe:2.3:o:netgear:rax200_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rax200:-:*:*:*:*:*:*:*

>>rax75_firmware>>Versions before 1.0.6.138(exclusive)

cpe:2.3:o:netgear:rax75_firmware:*:*:*:*:*:*:*:*

>>rax75>>-

cpe:2.3:h:netgear:rax75:-:*:*:*:*:*:*:*

>>rax80_firmware>>Versions before 1.0.6.138(exclusive)

cpe:2.3:o:netgear:rax80_firmware:*:*:*:*:*:*:*:*

>>rax80>>-

cpe:2.3:h:netgear:rax80:-:*:*:*:*:*:*:*

>>rs400_firmware>>Versions before 1.5.1.86(exclusive)

cpe:2.3:o:netgear:rs400_firmware:*:*:*:*:*:*:*:*

>>rs400>>-

cpe:2.3:h:netgear:rs400:-:*:*:*:*:*:*:*

>>r7100lg_firmware>>Versions before 1.0.0.76(exclusive)

cpe:2.3:o:netgear:r7100lg_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:r7100lg:-:*:*:*:*:*:*:*

>>wndr3400_firmware>>Versions before 1.0.1.44(exclusive)

cpe:2.3:o:netgear:wndr3400_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:wndr3400:v3:*:*:*:*:*:*:*

>>wnr3500l_firmware>>Versions before 1.2.0.72(exclusive)

cpe:2.3:o:netgear:wnr3500l_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:wnr3500l:v2:*:*:*:*:*:*:*

>>xr300_firmware>>Versions before 1.0.3.72(exclusive)

cpe:2.3:o:netgear:xr300_firmware:*:*:*:*:*:*:*:*

>>xr300>>-

cpe:2.3:h:netgear:xr300:-:*:*:*:*:*:*:*

>>dc112a_firmware>>Versions before 1.0.0.64(exclusive)

cpe:2.3:o:netgear:dc112a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:dc112a:-:*:*:*:*:*:*:*

>>d6220_firmware>>Versions before 1.0.0.80(exclusive)

cpe:2.3:o:netgear:d6220_firmware:*:*:*:*:*:*:*:*

>>d6220>>-

cpe:2.3:h:netgear:d6220:-:*:*:*:*:*:*:*

>>d6400_firmware>>Versions before 1.0.0.114(exclusive)

cpe:2.3:o:netgear:d6400_firmware:*:*:*:*:*:*:*:*

>>d6400>>-

cpe:2.3:h:netgear:d6400:-:*:*:*:*:*:*:*

>>ex3700_firmware>>Versions before 1.0.0.96(exclusive)

cpe:2.3:o:netgear:ex3700_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:ex3700:-:*:*:*:*:*:*:*

>>ex3800_firmware>>Versions before 1.0.0.96(exclusive)

cpe:2.3:o:netgear:ex3800_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:ex3800:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-120	Primary	zdi-disclosures@trendmicro.com

CWE ID: CWE-120

Type: Primary

Source: zdi-disclosures@trendmicro.com

References

Hyperlink	Source	Resource
https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323	zdi-disclosures@trendmicro.com	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-519/	zdi-disclosures@trendmicro.com	Third Party Advisory VDB Entry

Hyperlink: https://kb.netgear.com/000064720/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0323

Source: zdi-disclosures@trendmicro.com

Resource:

Vendor Advisory

Hyperlink: https://www.zerodayinitiative.com/advisories/ZDI-22-519/

Source: zdi-disclosures@trendmicro.com

Resource:

Third Party Advisory

VDB Entry