CVE-2022-27646

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-29 · updated 2026-06-17
Weakness: CWE-121

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15879.

Affected products

NETGEAR Cbr40 Firmware: before 2.5.0.28 — fixed in 2.5.0.28
NETGEAR Lbr1020 Firmware: before 2.7.4.2 — fixed in 2.7.4.2
NETGEAR Lbr20 Firmware: before 2.7.4.2 — fixed in 2.7.4.2
NETGEAR R6400 Firmware: before 1.0.4.126 — fixed in 1.0.4.126
NETGEAR R6700: before 1.0.4.126 — fixed in 1.0.4.126
NETGEAR R6900P Firmware: before 1.3.3.148 — fixed in 1.3.3.148
NETGEAR R7000: before 1.0.11.134 — fixed in 1.0.11.134
NETGEAR R7000P: before 1.3.3.148 — fixed in 1.3.3.148
NETGEAR R7850 Firmware: before 1.0.5.84 — fixed in 1.0.5.84
NETGEAR R7960P Firmware: before 1.4.3.88 — fixed in 1.4.3.88
NETGEAR R8000 Firmware: before 1.0.4.84 — fixed in 1.0.4.84
NETGEAR R8000P Firmware: before 1.4.3.88 — fixed in 1.4.3.88
NETGEAR Rax200 Firmware: before 1.0.6.138 — fixed in 1.0.6.138
NETGEAR Rax75 Firmware: before 1.0.6.138 — fixed in 1.0.6.138
NETGEAR Rax80 Firmware: before 1.0.6.138 — fixed in 1.0.6.138
NETGEAR Rbr10 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rbr20 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rbr40 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rbr50 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rbs10 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rbs20 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rbs40 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rbs50 Firmware: before 2.7.4.24 — fixed in 2.7.4.24
NETGEAR Rs400 Firmware: before 1.5.1.86 — fixed in 1.5.1.86

How to fix

Upgrade to a fixed version: NETGEAR Cbr40 Firmware 2.5.0.28; NETGEAR Lbr1020 Firmware 2.7.4.2; NETGEAR Lbr20 Firmware 2.7.4.2; NETGEAR R6400 Firmware 1.0.4.126; NETGEAR R6700 1.0.4.126; NETGEAR R6900P Firmware 1.3.3.148; NETGEAR R7000 1.0.11.134; NETGEAR R7000P 1.3.3.148; NETGEAR R7850 Firmware 1.0.5.84; NETGEAR R7960P Firmware 1.4.3.88; NETGEAR R8000 Firmware 1.0.4.84; NETGEAR R8000P Firmware 1.4.3.88. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-27646 or the next vulnerability affects your stack