← Vulnerability feed

Vulnerability record · CVE-2020-15636 · published 20 August 2020

CVE-2020-15636: Netgear r6700 firmware stack-based buffer overflow vulnerability

Netgear · R6700 Firmware

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the check_ra service. A crafted raePolicyVersion in a RAE_Policy.json file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9852.

9.8 CVSS 3.1 Critical EPSS 8.5% · top 5.1% CWE-121 · Stack-based buffer overflow
9.8CVSS 3.1 base score, v2 10.0
8.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the check_ra service. A crafted raePolicyVersion in a RAE_Policy.json file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9852.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-937/ Third Party AdvisoryVDB Entry
https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224 Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-937/ Third Party AdvisoryVDB Entry

Track CVE-2020-15636 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2016-6277NETGEAR router cgi-bin command injection allows remote code executionMultiple NETGEAR router models fail to sanitize shell metacharacters in the path info passed to cgi-bin/, allowing remote command execution. The flaw…KEVEPSS 100%analysed9.8CVE-2023-30280Netgear r6900 firmware classic buffer overflow vulnerabilityBuffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute arbitrary …EPSS 1.2%9.8CVE-2021-45512Netgear d7000 firmware broken cryptographic algorithm vulnerabilityCertain NETGEAR devices are affected by weak cryptography. This affects D7000v2 before 1.0.0.62, D8500 before 1.0.3.50, EX3700 before 1.0.0.84, EX380…EPSS 0.54%9.8CVE-2021-38516Netgear d6220 firmware vulnerabilityCertain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D700…EPSS 1.3%9.8CVE-2020-35795Netgear ac2100 firmware classic buffer overflow vulnerabilityCertain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72…EPSS 1.2%9.8CVE-2020-35796Netgear cbr40 firmware classic buffer overflow vulnerabilityCertain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects CBR40 before 2.5.0.10, D6220 before 1.0.0.60, …EPSS 1.3%9.8CVE-2020-26927Netgear ac2100 firmware vulnerabilityCertain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.42, R60…EPSS 1.1%9.8CVE-2018-21162Netgear d6400 firmware os command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6400 before 1.0.0.78, EX6200 before 1.0.3.86,…EPSS 3.4%

Source: NIST National Vulnerability Database (record CVE-2020-15636), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.