CVE-2020-10923: NETGEAR R6700 router UPnP authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated network-adjacent authentication bypass on an internet-edge router with a CVSS of 8.8 and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

The UPnP service on NETGEAR R6700 firmware V1.0.4.84_10.0.58, listening on TCP port 5000, fails to properly enforce authentication, so a crafted UPnP message bypasses it. Because the router is the network gateway, this flaw matters: it is a foothold that can be chained with other bugs to run code as root.

Impact

An attacker gains unauthenticated access past the UPnP authentication check and, per the advisory, can combine this with other vulnerabilities to execute arbitrary code with root privileges on the router.

Attack surface

Reachable by network-adjacent attackers over TCP port 5000; no authentication and no user interaction are required per the CVSS vector (AV:A/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no public exploit tags appear in the references, but EPSS is very high at 0.847 (99.7th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade the R6700 firmware to a version later than V1.0.4.84_10.0.58 if NETGEAR provides one; verify the fixed release on NETGEAR's advisory page.
• If no fix is available, disable the UPnP service on the router and block inbound TCP port 5000 from untrusted network segments.
• Restrict management and UPnP exposure to a trusted LAN segment; do not expose the router's UPnP service to guest, wireless-client or WAN-adjacent networks.
• Replace end-of-support R6700 units that no longer receive firmware fixes.
• Monitor NETGEAR and ZDI advisories for updated remediation guidance for this device.

Detection

• Monitor router and perimeter logs for unexpected inbound connections to TCP port 5000 from adjacent hosts.
• Alert on UPnP traffic to the router from hosts that do not normally use UPnP, especially outside maintenance windows.
• Watch for anomalous router behavior such as unexpected configuration changes, new port forwards or processes, which may indicate chained exploitation.
• Inventory R6700 devices still running V1.0.4.84_10.0.58 and flag them for remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.