Arbitrary Code Execution Vulnerability in NETGEAR R6260 Router

CVE-2021-34980

Summary

This vulnerability affects NETGEAR R6260 routers, allowing network-adjacent attackers to execute arbitrary code without authentication. The flaw exists in the setupwizard.cgi page, where the SOAP_LOGIN_TOKEN variable is improperly validated. This oversight leads to a buffer overflow, enabling attackers to run code with root privileges, thus compromising the device. Users are encouraged to review security advisories and update their router firmware to mitigate risks.

References