variot - var-202102-0332

var-202102-0332

Vulnerability from variot

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076. NETGEAR Orbi Has OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-11076 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Show details on source website

JSON

To clipboard

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "ex8000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "1.0.1.224"
      },
      {
        "_id": null,
        "model": "rbk20 router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "ex6200",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "1.0.1.82"
      },
      {
        "_id": null,
        "model": "rbk43 satellite",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbk15",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.44"
      },
      {
        "_id": null,
        "model": "rbr50",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.40"
      },
      {
        "_id": null,
        "model": "rbk20 satellite",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbk50",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.40"
      },
      {
        "_id": null,
        "model": "rbk12",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.44"
      },
      {
        "_id": null,
        "model": "rbs10",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.44"
      },
      {
        "_id": null,
        "model": "cbk43",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbr40",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbk13",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.44"
      },
      {
        "_id": null,
        "model": "rbk52w",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.40"
      },
      {
        "_id": null,
        "model": "rbk30",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "cbr40",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbk44 router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbk43s satellite",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "ex7700",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "1.0.0.210"
      },
      {
        "_id": null,
        "model": "rbk43 router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbs40",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbk14",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.44"
      },
      {
        "_id": null,
        "model": "rbk20w",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "cbk40",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbk22 router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbr20",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbk23 satellite",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbk33",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbk23w",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbk40 satellite",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbr10",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.44"
      },
      {
        "_id": null,
        "model": "rbk22 satellite",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbk43s router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbk50v",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.40"
      },
      {
        "_id": null,
        "model": "rbk40 router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbk23 router",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.36"
      },
      {
        "_id": null,
        "model": "rbs20",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "rbs50",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.40"
      },
      {
        "_id": null,
        "model": "rbk44 satellite",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "netgear",
        "version": "2.6.1.38"
      },
      {
        "_id": null,
        "model": "cbk43",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "rbk12",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "cbr40",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "ex7700",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "ex6200",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "ex8000",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "cbk40",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "rbk15",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "rbk13",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "rbk14",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30cd\u30c3\u30c8\u30ae\u30a2",
        "version": null
      },
      {
        "_id": null,
        "model": "orbi",
        "scope": null,
        "trust": 0.7,
        "vendor": "netgear",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-1430"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27861"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Shaunak Mirani",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-1430"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-27861",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 8.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 6.5,
            "id": "CVE-2020-27861",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT",
            "author": "zdi-disclosures@trendmicro.com",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-27861",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-27861",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2020-27861",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 0.7,
            "userInteraction": "NONE",
            "vectorString": "AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2020-27861",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "zdi-disclosures@trendmicro.com",
            "id": "CVE-2020-27861",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2020-27861",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "ZDI",
            "id": "CVE-2020-27861",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202102-1082",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-27861",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-1430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27861"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27861"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27861"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076. NETGEAR Orbi Has OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-11076 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-27861"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      },
      {
        "db": "ZDI",
        "id": "ZDI-20-1430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27861"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-27861",
        "trust": 3.2
      },
      {
        "db": "ZDI",
        "id": "ZDI-20-1430",
        "trust": 3.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-11076",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27861",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-1430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27861"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27861"
      }
    ]
  },
  "id": "VAR-202102-0332",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.259371377
  },
  "last_update_date": "2024-11-23T22:29:19.265000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "Security\u00a0Advisory\u00a0for\u00a0Unauthenticated\u00a0Command\u00a0Injection\u00a0Vulnerability\u00a0on\u00a0Some\u00a0Extenders\u00a0and\u00a0Orbi\u00a0WiFi\u00a0Systems,\u00a0PSV-2020-0301",
        "trust": 0.8,
        "url": "https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems-PSV-2020-0301"
      },
      {
        "title": "NETGEAR has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems"
      },
      {
        "title": "Netgear NETGEAR Fixes for operating system command injection vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=142366"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/f1tao/awesome-iot-security-resource "
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-1430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27861"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-78",
        "trust": 1.0
      },
      {
        "problemtype": "OS Command injection (CWE-78) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27861"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.5,
        "url": "https://www.zerodayinitiative.com/advisories/zdi-20-1430/"
      },
      {
        "trust": 2.4,
        "url": "https://kb.netgear.com/000062507/security-advisory-for-unauthenticated-command-injection-vulnerability-on-some-extenders-and-orbi-wifi-systems"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27861"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/78.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/f1tao/awesome-iot-security-resource"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-20-1430"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27861"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27861"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-20-1430",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-27861",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2020-27861",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-12-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-20-1430",
        "ident": null
      },
      {
        "date": "2021-02-12T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-27861",
        "ident": null
      },
      {
        "date": "2021-10-29T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-015997",
        "ident": null
      },
      {
        "date": "2021-02-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202102-1082",
        "ident": null
      },
      {
        "date": "2021-02-12T00:15:12.500000",
        "db": "NVD",
        "id": "CVE-2020-27861",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2020-12-15T00:00:00",
        "db": "ZDI",
        "id": "ZDI-20-1430",
        "ident": null
      },
      {
        "date": "2021-03-23T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-27861",
        "ident": null
      },
      {
        "date": "2021-10-29T09:04:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-015997",
        "ident": null
      },
      {
        "date": "2021-03-19T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202102-1082",
        "ident": null
      },
      {
        "date": "2024-11-21T05:21:57.107000",
        "db": "NVD",
        "id": "CVE-2020-27861",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote or local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "NETGEAR\u00a0Orbi\u00a0 In \u00a0OS\u00a0 Command injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-015997"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "operating system commend injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202102-1082"
      }
    ],
    "trust": 0.6
  }
}

cve-2020-27861

Vulnerability from cvelistv5

Published

2021-02-11 23:35

Modified

2024-08-04 16:25

Severity ?

8.8 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://www.zerodayinitiative.com/advisories/ZDI-20-1430/	x_refsource_MISC
	https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	NETGEAR	Orbi	Version: 2.5.1.16

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:25:43.503Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1430/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Orbi",
          "vendor": "NETGEAR",
          "versions": [
            {
              "status": "affected",
              "version": "2.5.1.16"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Shaunak Mirani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-12T13:50:22",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1430/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "zdi-disclosures@trendmicro.com",
          "ID": "CVE-2020-27861",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Orbi",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2.5.1.16"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NETGEAR"
              }
            ]
          }
        },
        "credit": "Shaunak Mirani",
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076."
            }
          ]
        },
        "impact": {
          "cvss": {
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.zerodayinitiative.com/advisories/ZDI-20-1430/",
              "refsource": "MISC",
              "url": "https://www.zerodayinitiative.com/advisories/ZDI-20-1430/"
            },
            {
              "name": "https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems",
              "refsource": "MISC",
              "url": "https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2020-27861",
    "datePublished": "2021-02-11T23:35:36",
    "dateReserved": "2020-10-27T00:00:00",
    "dateUpdated": "2024-08-04T16:25:43.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted