PT-2020-16816 · NetGear · Netgear Orbi

Shaunak Mirani · Published 2020-12-15 · Updated 2022-07-03 · CVE-2020-27861

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR Orbi version 2.5.1.16

Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi routers. Authentication is not required to exploit this issue. The specific flaw exists within the UA Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this issue to execute code in the context of root.

Recommendations For NETGEAR Orbi version 2.5.1.16, consider disabling the UA Parser utility until a patch is available to prevent exploitation. Restrict access to the router's DHCP request handling to minimize the risk of exploitation. Avoid using the Host Name option in DHCP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-27861

ZDI-20-1430

Affected Products

Netgear Orbi

References · 9

• https://osv.dev/vulnerability/CVE-2020-27861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27861 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-1430 · Security Note
• https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems · Vendor Advisory
• https://t.me/rnetsec/16997 · Telegram Post
• https://t.me/cvenotify/9990 · Telegram Post
• https://t.me/cvenotify/9836 · Telegram Post
• https://t.me/defcon_news/101035 · Telegram Post
• https://t.me/secharvester/12599 · Telegram Post