CVE-2020-28373
High
Description
upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Netgear R6400v2 Firmware
PublishedNov 9, 2020
First seenNov 9, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netgear r6400v2_firmware | 1.0.4.102_10.0.75 | — |
| netgear r6400_firmware | 1.0.1.62_1.0.41 | — |
| netgear r7000p_firmware | 1.3.2.126_10.1.66 | — |
| netgear xr300_firmware | 1.0.3.50_10.3.36 | — |
| netgear r8000_firmware | 1.0.4.62 | — |
| netgear r8300_firmware | 1.0.2.136 | — |
| netgear r8500_firmware | 1.0.2.136 | — |
| netgear r7300dst_firmware | 1.0.0.74 | — |
| netgear r7850_firmware | 1.0.5.64 | — |
| netgear r7900_firmware | 1.0.4.30 | — |
| netgear rax20_firmware | 1.0.2.64 | — |
| netgear rax80_firmware | 1.0.3.102 | — |
| netgear r6250_firmware | 1.0.4.44 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.