CVE-2022-27646 Memory corruption in R6700v3
A stack-based buffer overflow in the circled daemon allows network-adjacent attackers to execute arbitrary code as root, bypassing authentication.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-27646?
CVE-2022-27646 is a high-severity memory corruption vulnerability in Netgear R6400 Firmware, published on 29 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15879.
Weakness: CWE-121
Which versions are affected by CVE-2022-27646?
It affects 24 products.
Products include Netgear Cbr40 Firmware, Netgear Lbr1020 Firmware, Netgear Lbr20 Firmware, Netgear R6400 Firmware, Netgear R6700 Firmware, Netgear R6900p Firmware and 18 more.
How do I fix CVE-2022-27646?
No fix has been published for CVE-2022-27646 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-27646 being exploited?
There is no known exploitation of CVE-2022-27646 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Netgear R6400 Firmware
Sources
Also known as GHSA-qjg8-7gjq-vxf4.