What’s Vulnerable › Vulnerabilities

CVE-2020-27861

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-12 · updated 2026-06-17
• Weakness: CWE-78

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076.

Affected products

• NETGEAR Cbk40 Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Cbk43 Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Cbr40 Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• Netgear EX6200: before 1.0.1.82 — fixed in 1.0.1.82
• NETGEAR Ex7700 Firmware: before 1.0.0.210 — fixed in 1.0.0.210
• NETGEAR Ex8000 Firmware: before 1.0.1.224 — fixed in 1.0.1.224
• NETGEAR Rbk12 Firmware: before 2.6.1.44 — fixed in 2.6.1.44
• NETGEAR Rbk13 Firmware: before 2.6.1.44 — fixed in 2.6.1.44
• NETGEAR Rbk14 Firmware: before 2.6.1.44 — fixed in 2.6.1.44
• NETGEAR Rbk15 Firmware: before 2.6.1.44 — fixed in 2.6.1.44
• NETGEAR Rbk20 Router Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk20 Satellite Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Rbk20W Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk22 Router Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk22 Satellite Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Rbk23 Router Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk23 Satellite Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Rbk23W Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk30 Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk33 Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk40 Router Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk40 Satellite Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Rbk43 Router Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk43 Satellite Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Rbk43S Router Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk43S Satellite Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Rbk44 Router Firmware: before 2.6.1.36 — fixed in 2.6.1.36
• NETGEAR Rbk44 Satellite Firmware: before 2.6.1.38 — fixed in 2.6.1.38
• NETGEAR Rbk50 Firmware: before 2.6.1.40 — fixed in 2.6.1.40
• NETGEAR Rbk50V Firmware: before 2.6.1.40 — fixed in 2.6.1.40

How to fix

Upgrade to a fixed version: NETGEAR Cbk40 Firmware 2.6.1.38; NETGEAR Cbk43 Firmware 2.6.1.38; NETGEAR Cbr40 Firmware 2.6.1.38; Netgear EX6200 1.0.1.82; NETGEAR Ex7700 Firmware 1.0.0.210; NETGEAR Ex8000 Firmware 1.0.1.224; NETGEAR Rbk12 Firmware 2.6.1.44; NETGEAR Rbk13 Firmware 2.6.1.44; NETGEAR Rbk14 Firmware 2.6.1.44; NETGEAR Rbk15 Firmware 2.6.1.44; NETGEAR Rbk20 Router Firmware 2.6.1.36; NETGEAR Rbk20 Satellite Firmware 2.6.1.38. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems
• https://www.zerodayinitiative.com/advisories/ZDI-20-1430/
• https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems
• https://www.zerodayinitiative.com/advisories/ZDI-20-1430/

Get alerted when CVE-2020-27861 or the next vulnerability affects your stack