Arbitrary Code Execution Flaw in NETGEAR R6260 Router

CVE-2021-34979

Summary

A significant vulnerability in the NETGEAR R6260 router permits network-adjacent attackers to execute arbitrary code. This flaw arises from improper validation in the handling of SOAP requests, particularly the SOAPAction header. By exploiting the lack of length validation for user-supplied data, an attacker can write to a fixed-length buffer, allowing execution of code with root privileges. No authentication is necessary to exploit this vulnerability, making it crucial for users to ensure their devices are up to date. For more information, users can consult the relevant security advisory from NETGEAR.

References