var-202007-0053
Vulnerability from variot
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648. Zero Day Initiative To this vulnerability ZDI-CAN-9648 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR R6700 is a wireless router made by NETGEAR.
NETGEAR R6700 V1.0.4.84_10.0.58 has a verification problem in the firmware update processing process, which is caused by the program's failure to correctly verify the firmware image before the update
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "r6700",
"scope": "eq",
"trust": 1.8,
"vendor": "netgear",
"version": "1.0.4.84_10.0.58"
},
{
"_id": null,
"model": "r6700",
"scope": null,
"trust": 0.7,
"vendor": "netgear",
"version": null
},
{
"_id": null,
"model": "r6700 v1.0.4.84 10.0.58",
"scope": null,
"trust": 0.6,
"vendor": "netgear",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-706"
},
{
"db": "CNVD",
"id": "CNVD-2020-43149"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
},
{
"db": "NVD",
"id": "CVE-2020-10926"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:netgear:r6700_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
}
]
},
"credits": {
"_id": null,
"data": "Pedro Ribeiro and Radek Domanski of Team Flashback",
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-706"
}
],
"trust": 0.7
},
"cve": "CVE-2020-10926",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CVE-2020-10926",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2020-008750",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2020-43149",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2020-10926",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "zdi-disclosures@trendmicro.com",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"id": "CVE-2020-10926",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2020-008750",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "HIGH",
"attackVector": "ADJACENT",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"id": "ZDI-20-706",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "NONE",
"vectorString": "AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2020-10926",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "zdi-disclosures@trendmicro.com",
"id": "CVE-2020-10926",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "JVNDB-2020-008750",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "ZDI-20-706",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2020-43149",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202007-1644",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-706"
},
{
"db": "CNVD",
"id": "CNVD-2020-43149"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1644"
},
{
"db": "NVD",
"id": "CVE-2020-10926"
},
{
"db": "NVD",
"id": "CVE-2020-10926"
}
]
},
"description": {
"_id": null,
"data": "This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648. Zero Day Initiative To this vulnerability ZDI-CAN-9648 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR R6700 is a wireless router made by NETGEAR. \n\r\n\r\nNETGEAR R6700 V1.0.4.84_10.0.58 has a verification problem in the firmware update processing process, which is caused by the program\u0027s failure to correctly verify the firmware image before the update",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-10926"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
},
{
"db": "ZDI",
"id": "ZDI-20-706"
},
{
"db": "CNVD",
"id": "CNVD-2020-43149"
}
],
"trust": 2.79
},
"external_ids": {
"_id": null,
"data": [
{
"db": "ZDI",
"id": "ZDI-20-706",
"trust": 3.7
},
{
"db": "NVD",
"id": "CVE-2020-10926",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2020-008750",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-9648",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2020-43149",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1644",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-20-706"
},
{
"db": "CNVD",
"id": "CNVD-2020-43149"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1644"
},
{
"db": "NVD",
"id": "CVE-2020-10926"
}
]
},
"id": "VAR-202007-0053",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-43149"
}
],
"trust": 1.4180177333333333
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-43149"
}
]
},
"last_update_date": "2024-11-23T23:04:18.587000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.netgear.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-494",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
},
{
"db": "NVD",
"id": "CVE-2020-10926"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.0,
"url": "https://www.zerodayinitiative.com/advisories/zdi-20-706/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10926"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10926"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-43149"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1644"
},
{
"db": "NVD",
"id": "CVE-2020-10926"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "ZDI",
"id": "ZDI-20-706",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2020-43149",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2020-008750",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-202007-1644",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2020-10926",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2020-06-15T00:00:00",
"db": "ZDI",
"id": "ZDI-20-706",
"ident": null
},
{
"date": "2020-07-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-43149",
"ident": null
},
{
"date": "2020-09-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-008750",
"ident": null
},
{
"date": "2020-07-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202007-1644",
"ident": null
},
{
"date": "2020-07-28T18:15:13.833000",
"db": "NVD",
"id": "CVE-2020-10926",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2020-06-15T00:00:00",
"db": "ZDI",
"id": "ZDI-20-706",
"ident": null
},
{
"date": "2020-07-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-43149",
"ident": null
},
{
"date": "2020-09-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-008750",
"ident": null
},
{
"date": "2020-07-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202007-1644",
"ident": null
},
{
"date": "2024-11-21T04:56:23.073000",
"db": "NVD",
"id": "CVE-2020-10926",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202007-1644"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "NETGEAR R6700 Vulnerability in incomplete integrity verification of downloaded code on router",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-008750"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202007-1644"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.