Remote Code Execution Vulnerability in NETGEAR R7800 Routers
CVE-2021-34947

8.8HIGH

Key Information:

Vendor

Netgear
Status
R7800
Vendor
CVE Published:
7 May 2024

What is CVE-2021-34947?

The vulnerability affects NETGEAR R7800 routers, enabling potential attackers on the same network to execute arbitrary code without authentication. This issue arises from inadequate validation of user-supplied data within the parsing of the soap_block_table file, which can lead to a write past the allocated data structure. As a consequence, attackers may exploit this flaw to execute code with root privileges, posing a significant security risk to affected devices.

Affected Version(s)

R7800 1.0.2.82

References

https://www.zerodayinitiative.com/advisories/ZDI-21-1116/
x_research-advisory
https://kb.netgear.com/000064044/Security-Advisory-for-Pr...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.