Netgear EX3700 mtd sub_41619C stack-based overflow

Vulnerability

A stack-based buffer overflow vulnerability exists in the function sub_41619C within the /mtd file of Netgear EX3700 routers. The flaw occurs at offset 0x0041684C where strcat is called without proper bounds checking, allowing a user-supplied GET request to overflow a stack buffer. All firmware versions before 1.0.0.88 are affected [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP GET request to the device's web server (port 80). The request must include a path starting with /mtd followed by data exceeding the 100-byte buffer v22, causing a stack buffer overflow. The proof-of-concept demonstrates a simple Python script that sends such a request, triggering the overflow [1][2]. No authentication is required; the attack can be performed remotely over the network.

Impact

Successful exploitation leads to a stack-based buffer overflow, which can corrupt memory and potentially allow arbitrary code execution on the device. Given the device's elevated privileges, an attacker could gain full control of the router, leading to information disclosure, denial of service, or further network compromise. The vulnerability is publicly disclosed and exploitation is considered likely [1].

Mitigation

Netgear has released firmware version 1.0.0.98 to address this issue [1]. However, the EX3700 is an end-of-life (EOL) product and is no longer supported by the vendor. Users are strongly advised to upgrade to a supported device as no official workarounds are available. The vulnerability is tracked as CVE-2025-5934 and is publicly known.