Remote Code Execution Vulnerability in NETGEAR Routers

CVE-2020-27867

Summary

A remote code execution vulnerability exists within the mini_httpd service of various NETGEAR router models, enabling network-adjacent attackers to execute arbitrary code. Although the vulnerability requires authentication, it can be exploited due to insufficient validation of parameters processed by the service. Attackers can bypass this authentication mechanism and leverage the flaw when the router accepts user input for system calls, potentially gaining root access.

References