Arbitrary Code Execution Flaw in NETGEAR R6260 Router
CVE-2021-34979

8.8HIGH

Key Information:

Vendor

Netgear
Status
R6260
Vendor
CVE Published:
13 January 2022

What is CVE-2021-34979?

A significant vulnerability in the NETGEAR R6260 router permits network-adjacent attackers to execute arbitrary code. This flaw arises from improper validation in the handling of SOAP requests, particularly the SOAPAction header. By exploiting the lack of length validation for user-supplied data, an attacker can write to a fixed-length buffer, allowing execution of code with root privileges. No authentication is necessary to exploit this vulnerability, making it crucial for users to ensure their devices are up to date. For more information, users can consult the relevant security advisory from NETGEAR.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

R6260 1.1.0.78_1.0.1

References

https://www.zerodayinitiative.com/advisories/ZDI-21-1241/
x_refsource_MISC
https://kb.netgear.com/000064261/Security-Advisory-for-Ve...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sherman Chann Zhi Shen & Hoang Thach Nguyen (d4rkn3ss)
JSON
.