| |
Vulnerability CVE-2020-10923
Published: 2020-07-28
Description: |
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642. |
Type:
CWE-305 (Authentication Bypass by Primary Weakness)
CVSS2 => (AV:A/AC:L/Au:N/C:C/I:C/A:C)
CVSS Base Score |
Impact Subscore |
Exploitability Subscore |
8.3/10 |
10/10 |
6.5/10 |
Exploit range |
Attack complexity |
Authentication |
Adjacent network |
Low |
No required |
Confidentiality impact |
Integrity impact |
Availability impact |
Complete |
Complete |
Complete |
References: |
https://www.zerodayinitiative.com/advisories/ZDI-20-703/
|
|
|
Copyright 2024, cxsecurity.com
|
|
|