CVE-2020-10923

HIGH

NETGEAR R6700 V1.0.4.84_10.0.58 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-10923. Includes Metasploit module auxiliary/admin/http/netgear_r6700_pass_reset.

AI-analyzed exploit summary This Metasploit module exploits CVE-2020-10924, a buffer overflow in the UPnP daemon of Netgear R6700v3 routers, to reset the admin password to the factory default. It leverages an authentication bypass (CVE-2020-10923) to send a malformed SOAP request, triggering the vulnerability.

Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.

Exploits (1)

metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r6700_pass_reset.rb

This Metasploit module exploits CVE-2020-10924, a buffer overflow in the UPnP daemon of Netgear R6700v3 routers, to reset the admin password to the factory default. It leverages an authentication bypass (CVE-2020-10923) to send a malformed SOAP request, triggering the vulnerability.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Netgear R6700v3 firmware versions V1.0.2.62 to V1.0.4.84
No auth needed
Prerequisites: Network adjacency to the target router · UPnP service accessible on port 5000
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-20-703/

Scores

CVSS v3 8.8
EPSS 0.6024
EPSS Percentile 98.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-305
Status published
Products (1)
netgear/r6700_firmware 1.0.4.84_10.0.58
Published Jul 28, 2020
Tracked Since Feb 18, 2026