CVE-2022-27641

Vulnerability

A pre-authentication integer overflow vulnerability exists in the NetUSB module of NETGEAR R6700v3 routers running firmware version 1.0.4.120_10.0.91 [1][2]. The issue results from the lack of proper validation of user-supplied data, leading to an integer overflow before allocating a buffer [2]. This allows a buffer overflow that an unauthenticated, network-adjacent attacker can exploit [2].

Exploitation

An attacker must be on the same network segment as the vulnerable router (network-adjacent) [2]. No authentication is required [2]. The attacker sends specially crafted network data to the NetUSB service, causing an integer overflow during buffer size calculation, which then overflows the allocated buffer [2]. The exact sequence of steps is not publicly detailed but leverages the integer overflow to corrupt memory [2].

Impact

Successful exploitation allows the attacker to achieve arbitrary code execution in the context of root [2]. This results in full compromise of the router's confidentiality, integrity, and availability, as the attacker gains complete control over the device [2].

Mitigation

NETGEAR has released a fix in firmware version 1.0.4.122 for the R6700v3, available from the NETGEAR support site [1]. Users should update to this version immediately to mitigate the vulnerability [1].