Vulnerability Name:

CVE-2021-40847 (CCN-209789)

Assigned:2021-09-20
Published:2021-09-20
Updated:2021-10-07
Summary:The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. This affects R6400v2 1.0.4.106, R6700 1.0.2.16, R6700v3 1.0.4.106, R6900 1.0.2.16, R6900P 1.3.2.134, R7000 1.0.11.123, R7000P 1.3.2.134, R7850 1.0.5.68, R7900 1.0.4.38, R8000 1.0.4.68, and RS400 1.5.0.68.
CVSS v3 Severity:8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-319
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-40847

Source: MISC
Type: Exploit, Third Party Advisory
https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html

Source: XF
Type: UNKNOWN
netgear-cve202140847-code-exec(209789)

Source: CCN
Type: NETGEAR Security Advisory: PSV-2021-0204
Security Advisory for Remote Code Execution on Some Routers

Source: MISC
Type: Vendor Advisory
https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204

Vulnerable Configuration:Configuration 1:
  • cpe:/o:netgear:r6400v2_firmware:1.0.4.106:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r6400v2:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:netgear:r6700_firmware:1.0.2.16:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r6700:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:netgear:r6700v3_firmware:1.0.4.106:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r6700v3:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:netgear:r6900_firmware:1.0.2.16:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r6900:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:netgear:r6900p_firmware:1.3.2.134:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r6900p:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:netgear:r7000_firmware:1.0.11.123:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r7000:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:netgear:r7000p_firmware:1.3.2.134:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r7000p:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:netgear:r7850_firmware:1.0.5.68:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r7850:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:netgear:r7900_firmware:1.0.4.38:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r7900:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:netgear:r8000_firmware:1.0.4.68:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:r8000:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:netgear:rs400_firmware:1.5.0.68:*:*:*:*:*:*:*
  • AND
  • cpe:/h:netgear:rs400:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/h:netgear:r6700:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r6900:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r7000p:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r8000:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r6400:v2:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r6700:v3:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r7000:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r7850:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r7900:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:rs400:-:*:*:*:*:*:*:*
  • OR cpe:/h:netgear:r6900p:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    netgear r6400v2 firmware 1.0.4.106
    netgear r6400v2 -
    netgear r6700 firmware 1.0.2.16
    netgear r6700 -
    netgear r6700v3 firmware 1.0.4.106
    netgear r6700v3 -
    netgear r6900 firmware 1.0.2.16
    netgear r6900 -
    netgear r6900p firmware 1.3.2.134
    netgear r6900p -
    netgear r7000 firmware 1.0.11.123
    netgear r7000 -
    netgear r7000p firmware 1.3.2.134
    netgear r7000p -
    netgear r7850 firmware 1.0.5.68
    netgear r7850 -
    netgear r7900 firmware 1.0.4.38
    netgear r7900 -
    netgear r8000 firmware 1.0.4.68
    netgear r8000 -
    netgear rs400 firmware 1.5.0.68
    netgear rs400 -
    netgear r6700 -
    netgear r6900 -
    netgear r7000p -
    netgear r8000 -
    netgear r6400 v2
    netgear r6700 v3
    netgear r7000 -
    netgear r7850 -
    netgear r7900 -
    netgear rs400 -
    netgear r6900p -