ZDI-20-936: NETGEAR R6700 acsd Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the acsd service, which listens on TCP port 5916 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-20-936?
The severity of ZDI-20-936 is critical as it allows arbitrary code execution without authentication.
How do I fix ZDI-20-936?
To fix ZDI-20-936, update the NETGEAR R6700 firmware to the latest version provided by the manufacturer.
Who is affected by ZDI-20-936?
The vulnerability ZDI-20-936 affects users of NETGEAR R6700 routers running vulnerable firmware versions.
Can ZDI-20-936 be exploited remotely?
Yes, ZDI-20-936 can be exploited by network-adjacent attackers without requiring authentication.
What specifically causes ZDI-20-936?
ZDI-20-936 is caused by a buffer overflow in the acsd service that listens on TCP port 5916.