Read the docs
TI-2022-10627 Aliases CVE-2022-27646GHSA-qjg8-7gjq-vxf4

Stack-based buffer overflow in NETGEAR R6700v3

Priority MEDIUM 43CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15879.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01432 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NETGEARR6700v31.0.4.120_10.0.91—No fix listedCNA
  • R6700v3 VendorNETGEAR Affected 1.0.4.120_10.0.91 Fixed in — No fix listed CNA

CPE configurations NVD · 48

CPEVersionsRoleVendor
cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:*before 1.0.4.126VulnerableNETGEAR
cpe:2.3:h:netgear:r6400:v2:*:*:*:*:*:*:*v2Running onNETGEAR
cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*before 1.0.4.126VulnerableNETGEAR
cpe:2.3:h:netgear:r6700:v3:*:*:*:*:*:*:*v3Running onNETGEAR
cpe:2.3:o:netgear:r6900p_firmware:*:*:*:*:*:*:*:*before 1.3.3.148VulnerableNETGEAR
cpe:2.3:h:netgear:r6900p:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:*before 1.0.11.134VulnerableNETGEAR
cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r7000p_firmware:*:*:*:*:*:*:*:*before 1.3.3.148VulnerableNETGEAR
cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:r6400_firmware:*:*:*:*:*:*:*:* Versions before 1.0.4.126 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r6400:v2:*:*:*:*:*:*:* Versions v2 Running on ·NETGEAR
  • cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:* Versions before 1.0.4.126 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r6700:v3:*:*:*:*:*:*:* Versions v3 Running on ·NETGEAR
  • cpe:2.3:o:netgear:r6900p_firmware:*:*:*:*:*:*:*:* Versions before 1.3.3.148 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r6900p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:* Versions before 1.0.11.134 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r7000p_firmware:*:*:*:*:*:*:*:* Versions before 1.3.3.148 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
Show 38 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:netgear:r7850_firmware:*:*:*:*:*:*:*:*before 1.0.5.84VulnerableNETGEAR
cpe:2.3:h:netgear:r7850:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r7960p_firmware:*:*:*:*:*:*:*:*before 1.4.3.88VulnerableNETGEAR
cpe:2.3:h:netgear:r7960p:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r8000_firmware:*:*:*:*:*:*:*:*before 1.0.4.84VulnerableNETGEAR
cpe:2.3:h:netgear:r8000:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:r8000p_firmware:*:*:*:*:*:*:*:*before 1.4.3.88VulnerableNETGEAR
cpe:2.3:h:netgear:r8000p:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax200_firmware:*:*:*:*:*:*:*:*before 1.0.6.138VulnerableNETGEAR
cpe:2.3:h:netgear:rax200:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax75_firmware:*:*:*:*:*:*:*:*before 1.0.6.138VulnerableNETGEAR
cpe:2.3:h:netgear:rax75:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rax80_firmware:*:*:*:*:*:*:*:*before 1.0.6.138VulnerableNETGEAR
cpe:2.3:h:netgear:rax80:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rs400_firmware:*:*:*:*:*:*:*:*before 1.5.1.86VulnerableNETGEAR
cpe:2.3:h:netgear:rs400:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:cbr40_firmware:*:*:*:*:*:*:*:*before 2.5.0.28VulnerableNETGEAR
cpe:2.3:h:netgear:cbr40:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:*before 2.7.4.2VulnerableNETGEAR
cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:*before 2.7.4.2VulnerableNETGEAR
cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr10_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbr10:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr20_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbr20:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr40_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbr40:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr50_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbr50:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs10_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbs10:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs20_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbs20:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs40_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbs40:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs50_firmware:*:*:*:*:*:*:*:*before 2.7.4.24VulnerableNETGEAR
cpe:2.3:h:netgear:rbs50:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:r7850_firmware:*:*:*:*:*:*:*:* Versions before 1.0.5.84 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r7850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r7960p_firmware:*:*:*:*:*:*:*:* Versions before 1.4.3.88 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r7960p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r8000_firmware:*:*:*:*:*:*:*:* Versions before 1.0.4.84 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r8000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:r8000p_firmware:*:*:*:*:*:*:*:* Versions before 1.4.3.88 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:r8000p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax200_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.138 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax75_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.138 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax75:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rax80_firmware:*:*:*:*:*:*:*:* Versions before 1.0.6.138 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rax80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rs400_firmware:*:*:*:*:*:*:*:* Versions before 1.5.1.86 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rs400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:cbr40_firmware:*:*:*:*:*:*:*:* Versions before 2.5.0.28 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:cbr40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.2 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.2 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr10_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr20_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr40_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr50_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs10_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs20_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs40_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs40:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs50_firmware:*:*:*:*:*:*:*:* Versions before 2.7.4.24 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27646
  2. 2026-10-03 Alias added: GHSA-qjg8-7gjq-vxf4

References

Advisory 2

  • TI-2024-18843 An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28… CVSS 3.1HIGH 7.5
  • TI-2024-18842 An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear… CVSS 3.1MEDIUM 5.4
  • TI-2023-18149 Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote… CVSS 3.1CRITICAL 9.8
  • TI-2021-20709 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
  • TI-2021-20699 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
  • TI-2021-20717 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 10.0
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences