NETGEAR Nighthawk R7000P aws_json Unauthenticated Double Stack Buffer Overflow (Pre-Auth RCE)

Presentation

The NETGEAR Nighthawk R7000P is a popular dual-band WiFi router marketed with gaming-focused features, smart parental controls, and hardware powerful enough for home power users. During a vulnerability research engagement on a selection of embedded devices, HDW Sec discovered a pre-authentication remote code execution vulnerability reachable from the WAN interface.

The flaw resides in the /tmp/media/nand/router-analytics/aws_json binary. It is a double stack buffer overflow that can be triggered without authentication and leads to arbitrary code execution as root. Because the same vulnerable code is shared across several NETGEAR products, multiple router and Nighthawk Mesh models are affected. NETGEAR tracks the issue as advisory PSV-2022-0146, and it was assigned CVE-2022-48176.

Note on scoring: the NVD entry rates this issue 7.8 (High) with a local, low-privilege vector. The research below shows the flaw is in practice reachable pre-authentication from the WAN side via a man-in-the-middle position, which is materially more severe than that vector suggests.

Issue(s)

• The aws_json daemon fetches JSON from a remote server over HTTPS but invokes curl with the -k / --insecure option, disabling certificate verification. Any party able to intercept the traffic can impersonate the server.
• The JSON response is written to /tmp/xCloud_MAXmind and parsed with strcpy() calls that do not bound the copied field sizes, producing stack buffer overflows.
• The binary is compiled without ASLR, so its executable segment sits at a fixed, predictable address range, making the overflow reliably exploitable.
• The parser contains multiple strcpy() calls, allowing two overflows to be chained: one to stage the payload on the stack, one to control the program counter.
• aws_json runs as root, so successful exploitation yields full control of the device.

Full technical analysis

The complete write-up (root cause, exploitation, proof of concept) is available on the HDW Sec blog: https://www.hdwsec.fr/blog/20221109-netgear/

References

• HDW Sec blog: https://www.hdwsec.fr/blog/20221109-netgear/
• CVE-2022-48176 (NVD): https://nvd.nist.gov/vuln/detail/CVE-2022-48176