CVE-2020-27861 Command injection in Orbi
Network-adjacent attackers can execute arbitrary code as root on NETGEAR Orbi routers via a crafted DHCP request without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27861?
CVE-2020-27861 is a high-severity command injection vulnerability in Netgear Ex6200 Firmware, published on 11 Feb 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076.
Weakness: CWE-78
Which versions are affected by CVE-2020-27861?
It affects 39 products.
Products include Netgear Cbk40 Firmware, Netgear Cbk43 Firmware, Netgear Cbr40 Firmware, Netgear Ex6200 Firmware, Netgear Ex7700 Firmware, Netgear Ex8000 Firmware and 33 more.
How do I fix CVE-2020-27861?
No fix has been published for CVE-2020-27861 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-27861 being exploited?
There is no known exploitation of CVE-2020-27861 in the wild and no public exploit code.
Other vulnerabilities in Netgear Ex6200 Firmware
Sources
Also known as GHSA-jwqc-9f7p-v456.