CVE-2020-10924: NETGEAR R6700 UPnP service stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network-adjacent, no-authentication, no-interaction exploitation leading to root code execution, and a very high EPSS percentile, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

The UPnP service on NETGEAR R6700 routers (firmware V1.0.4.84_10.0.58) fails to validate the length of user-supplied data before copying it into a fixed-length stack buffer. A network-adjacent attacker can bypass the existing authentication mechanism and trigger a stack-based buffer overflow. Successful exploitation leads to code execution as root on the router.

Impact

An attacker gains arbitrary code execution with root privileges on the affected router, giving full control of the device and its network traffic. This can enable persistent compromise, traffic interception, or use of the router as a pivot into the local network.

Attack surface

The flaw is reached over the network via the UPnP service listening on TCP port 5000 by default; the CVSS vector (AV:A/PR:N/UI:N) indicates the attacker must be on the adjacent network but needs no credentials or user interaction, despite the description noting authentication can be bypassed.

Exploitation

No public exploitation is confirmed in this record: the CVE is not listed in CISA KEV and the only references are Zero Day Initiative advisories tagged Third Party Advisory and VDB Entry. EPSS is high (0.87343, 99.7th percentile), suggesting elevated likelihood of attempted exploitation.

What to do

• Apply the NETGEAR firmware update that addresses ZDI-CAN-9643; check the vendor advisory for the fixed version since the record does not name one.
• If no patch is available, disable the UPnP service on the router or block TCP port 5000 from untrusted network segments.
• Segment or firewall the router's management and UPnP interfaces so only trusted adjacent hosts can reach them.
• Monitor NETGEAR advisories for updated firmware and re-check exposure after patching.

Detection

• Monitor network traffic to TCP port 5000 on NETGEAR R6700 devices for oversized or malformed UPnP requests.
• Watch for unexpected process crashes or restarts of the UPnP service on affected routers.
• Alert on anomalous outbound connections or new listening services originating from the router after UPnP activity.
• Audit router logs for authentication bypass attempts or unusual UPnP SOAP requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.