Netgear EX6120 fwAcosCgiInbound buffer overflow

Vulnerability

A critical buffer overflow vulnerability exists in Netgear EX6120 firmware version 1.0.0.68 within the fwAcosCgiInbound function. The manipulation of the host argument leads to a buffer overflow, allowing an attacker to overwrite adjacent memory. The vulnerability is remotely exploitable without authentication. The vendor was contacted but did not respond [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the affected device, providing an overly long host parameter to the fwAcosCgiInbound function. No authentication or prior access is required; the attack can be launched over the network from any location.

Impact

Successful exploitation of the buffer overflow can lead to arbitrary code execution at the privilege level of the affected service, likely resulting in full compromise of the device. Alternatively, it may cause a denial of service by crashing the service. The exact impact depends on the attacker's payload and the memory layout.

Mitigation

As of the publication date (2025-04-30), no official patch or firmware update has been released by Netgear. The vendor did not respond to the disclosure [1]. Users should consider isolating the device from untrusted networks or replacing it with a supported model. No workaround is available.