CVE-2020-15636
📋 TL;DR
This is a critical remote code execution vulnerability in NETGEAR routers that allows unauthenticated attackers to execute arbitrary code with root privileges. The flaw exists in the check_ra service and can be exploited by sending a specially crafted RAE_Policy.json file. Affected users include anyone using vulnerable NETGEAR router models with specific firmware versions.
💻 Affected Systems
- NETGEAR R6400
- NETGEAR R6700
- NETGEAR R7000
- NETGEAR R7850
- NETGEAR R7900
- NETGEAR R8000
- NETGEAR RS400
- NETGEAR XR300
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router with root-level access, allowing attackers to intercept all network traffic, install persistent malware, pivot to internal networks, or brick the device.
Likely Case
Router takeover leading to man-in-the-middle attacks, credential theft, DNS hijacking, and botnet recruitment.
If Mitigated
No impact if patched or if the vulnerable service is disabled/blocked.
🎯 Exploit Status
ZDI published details and proof-of-concept. The vulnerability is straightforward to exploit with publicly available information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions (check NETGEAR advisory for specific patched versions)
Vendor Advisory: https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install latest firmware. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable Remote Management
allDisable remote administration features to prevent external exploitation.
Log into router admin interface and disable 'Remote Management' in Advanced > Administration > Remote Management
Block check_ra Service
allUse firewall rules to block access to the check_ra service port (typically port 80/443 for web interface).
Configure firewall to block inbound connections to router management ports from WAN interface
🧯 If You Can't Patch
- Replace vulnerable router with a different model or from a different vendor
- Place router behind another firewall that blocks all inbound management traffic
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under Advanced > Administration > Firmware UpdateCheck Version:
Log into router web interface and navigate to Advanced > Administration > Firmware Update to see current versionVerify Fix Applied:
Verify firmware version is newer than 1.0.4.84_10.0.58 and check that no unauthorized changes exist in router configuration📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /check_ra endpoint
- Multiple failed authentication attempts followed by successful exploitation
- Unexpected process execution or configuration changes
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Traffic patterns indicating man-in-the-middle activity
SIEM Query:
source="router_logs" AND (uri="/check_ra" OR process="check_ra")🔗 References
- https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224
- https://www.zerodayinitiative.com/advisories/ZDI-20-937/
- https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224
- https://www.zerodayinitiative.com/advisories/ZDI-20-937/
