CVE-2021-38526

Vulnerability

A buffer overflow vulnerability exists in the pre-authentication code path of certain NETGEAR routers. The affected models are RAX35, RAX38, and RAX40 running firmware versions prior to 1.0.3.94[1]. An unauthenticated attacker can trigger the overflow by sending a specially crafted network request to the device without any prior authentication[1].

Exploitation

An attacker must be on the same local network (adjacent) to reach the vulnerable code path[1]. No authentication or user interaction is required. By sending a malicious packet that exploits the buffer overflow, the attacker can corrupt memory on the device[1].

Impact

Successful exploitation allows an unauthenticated attacker to cause a denial of service (CIA impact: availability low)[1]. The CVSS v3 base score is 4.3 (Medium) with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L[1]. No confidentiality or integrity impact is expected.

Mitigation

NETGEAR has released fixed firmware version 1.0.3.94 for the RAX35, RAX38, and RAX40 models[1]. Users should download and install the latest firmware from NETGEAR Support as soon as possible[1]. No workarounds are provided; updating firmware is the recommended action.