CVE-2020-10929

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9768.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-680 CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jul 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-10937.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt CVE-2020-109306.5This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_CVE-2020-109317.5Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to try CVE-2020-109324.7An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurem CVE-2020-109335.3An issue was discovered in Ruby 2.5.x through 2.5.7, 2.6.x through 2.6.5, and 2.7.0. If a victim calls BasicSocket#read_nonblock(requested_s CVE-2020-109347.2Acyba AcyMailing before 6.9.2 mishandles file uploads by admins.CVE-2020-109355.4Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.CVE-2020-109367.8Sympa before 6.2.56 allows privilege escalation.CVE-2020-109377.5An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connectio CVE-2020-109389.8GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.CVE-2020-109397.8Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.CVE-2020-10947.8An elevation of privilege vulnerability exists when the Windows Work Folder Service improperly handles file operations, aka 'Windows Work Fo