CVE-2023-36187

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-01 · updated 2026-06-17
Weakness: CWE-120

Description

Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to httpd.

Affected products

NETGEAR Cbr40 Firmware: before 2.5.0.24 — fixed in 2.5.0.24
NETGEAR Lax20 Firmware: before 1.1.6.34 — fixed in 1.1.6.34
NETGEAR Mk62 Firmware: before 1.1.6.122 — fixed in 1.1.6.122
NETGEAR Mr60 Firmware: before 1.1.6.122 — fixed in 1.1.6.122
NETGEAR Ms60 Firmware: before 1.1.6.122 — fixed in 1.1.6.122
NETGEAR R6400 Firmware: before 1.0.1.70 — fixed in 1.0.1.70
NETGEAR R6400V2 Firmware: before 1.0.4.118 — fixed in 1.0.4.118
NETGEAR R6700V3 Firmware: before 1.0.4.118 — fixed in 1.0.4.118
NETGEAR R7000: before 1.0.11.130 — fixed in 1.0.11.130
NETGEAR R7000P: before 1.3.3.148 — fixed in 1.3.3.148
NETGEAR Rax200 Firmware: before 1.0.4.120 — fixed in 1.0.4.120
NETGEAR Rax75 Firmware: before 1.0.4.120 — fixed in 1.0.4.120
NETGEAR Rax80 Firmware: before 1.0.4.120 — fixed in 1.0.4.120
NETGEAR Rbw30 Firmware: before 2.6.2.6 — fixed in 2.6.2.6
NETGEAR Rs400 Firmware: before 1.5.1.86 — fixed in 1.5.1.86

How to fix

Upgrade to a fixed version: NETGEAR Cbr40 Firmware 2.5.0.24; NETGEAR Lax20 Firmware 1.1.6.34; NETGEAR Mk62 Firmware 1.1.6.122; NETGEAR Mr60 Firmware 1.1.6.122; NETGEAR Ms60 Firmware 1.1.6.122; NETGEAR R6400 Firmware 1.0.1.70; NETGEAR R6400V2 Firmware 1.0.4.118; NETGEAR R6700V3 Firmware 1.0.4.118; NETGEAR R7000 1.0.11.130; NETGEAR R7000P 1.3.3.148; NETGEAR Rax200 Firmware 1.0.4.120; NETGEAR Rax75 Firmware 1.0.4.120. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-36187 or the next vulnerability affects your stack