CVE-2022-27646

Vulnerability

A stack-based buffer overflow exists in the circled daemon of NETGEAR R6700v3 routers running firmware version 1.0.4.120_10.0.91. The vulnerability is triggered when a specially crafted circleinfo.txt file is processed, overflowing a fixed-length stack buffer. While authentication is required to reach the vulnerable code path, the authentication mechanism can be bypassed. This issue is also identified as ZDI-CAN-15879 [1][2].

Exploitation

An attacker must be network-adjacent and able to authenticate to the router, though authentication can be bypassed. The attacker supplies a malicious circleinfo.txt file to the circled daemon, which then overflows the stack buffer. This allows overwriting of return addresses and other critical stack data. The exploit does not require user interaction beyond the initial authentication [2].

Impact

Successful exploitation enables arbitrary code execution in the context of the root user. This gives the attacker full control over the affected router, allowing them to read, modify, or delete any data, install persistent malware, or pivot to other devices on the network [2].

Mitigation

NETGEAR released firmware version 1.0.4.126 for the R6700v3 to fix this vulnerability, as noted in the security advisory PSV-2021-0324 [1]. Users should update immediately. No workaround is available, and the router is not known to be on the CISA KEV list [1][2].