Kevin Denis

Name of the Vulnerable Software and Affected Versions: Wyze Cam v3 versions (affected versions not specified) Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Wyze Cam v3 IP cameras without authentication. The flaw resides within the Realtek Wi-Fi kernel module, resulting from insufficient validation of user-supplied data length before copying it into a heap-based buffer. Successful exploitation enables an attacker to execute code in the context of the kernel. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NETGEAR RAX30 AX2400 series of routers versions prior to 1.0.9.90 **Description** A network misconfiguration is present in the affected devices, where IPv6 is enabled for the WAN interface by default. However, the firewall restrictions in place for IPv4 traffic are not applied to the WAN interface for IPv6. This allows arbitrary access to services running on the device that may be listening via IPv6, such as the SSH and Telnet servers on ports 22 and 23. The misconfiguration could allow an attacker to interact with services intended only for local network clients. **Recommendations** For versions prior to 1.0.9.90, update to version 1.0.9.90 or later to resolve the issue. As a temporary workaround, consider disabling the SSH and Telnet servers until a patch is available. Restrict access to the WAN interface for IPv6 traffic to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NETGEAR R6700v3 version 1.0.4.120 10.0.91 NETGEAR R6400v2 (affected versions not specified) NETGEAR R6900P (affected versions not specified) NETGEAR R7000 (affected versions not specified) NETGEAR R7000P (affected versions not specified) NETGEAR RS400 (affected versions not specified) NETGEAR CBR40 (affected versions not specified) **Description** This issue allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR routers. Authentication is not required to exploit this issue. The specific flaw exists within the downloading of files via HTTPS, resulting from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of root. **Recommendations** For NETGEAR R6700v3 version 1.0.4.120 10.0.91, consider disabling the HTTPS file download feature until a patch is available. For NETGEAR R6400v2, NETGEAR R6900P, NETGEAR R7000, NETGEAR R7000P, NETGEAR RS400, and NETGEAR CBR40, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** NETGEAR R6400v2 (affected versions not specified) NETGEAR R6700v3 version 1.0.4.120 10.0.91 NETGEAR R6900P (affected versions not specified) NETGEAR R7000 (affected versions not specified) NETGEAR R7000P (affected versions not specified) NETGEAR RS400 (affected versions not specified) NETGEAR CBR40 (affected versions not specified) **Description** This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR routers. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the `circled` daemon. A crafted `circleinfo.txt` file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of `root`. **Recommendations** For NETGEAR R6400v2, restrict access to the `circled` daemon until a patch is available. For NETGEAR R6700v3 version 1.0.4.120 10.0.91, consider disabling the `circled` daemon as a temporary workaround. For NETGEAR R6900P, NETGEAR R7000, NETGEAR R7000P, NETGEAR RS400, and NETGEAR CBR40, at the moment, there is no information about a newer version that contains a fix for this issue.