Netgear EX6120 sub_30394 buffer overflow

Vulnerability

The vulnerability resides in Netgear EX6120 firmware version 1.0.3.94. The function sub_30394 is susceptible to a buffer overflow when processing the host argument. An attacker can remotely trigger this overflow by sending a specially crafted request, without requiring authentication.

Exploitation

An attacker needs only network access to the device. No credentials are necessary. The attack involves sending a malicious packet with an overly long host parameter to the vulnerable service, causing a buffer overflow that overwrites adjacent memory.

Impact

Successful exploitation can lead to arbitrary code execution on the device. An attacker could gain full control over the router, potentially leading to further compromise of connected networks and devices.

Mitigation

The vendor was contacted but did not respond. As of this publication, no official patch or firmware update is available. Users should consider replacing the device or restricting its exposure to untrusted networks (e.g., disable remote management, place behind a firewall).