NETGEAR Nighthawk R7000P upnpd Pre-Authentication Stack Buffer Overflow (Remote Code Execution)

Presentation

The NETGEAR Nighthawk R7000P is a popular dual-band Wi-Fi router advertised with gaming-focused features, smart parental controls, and internal hardware powerful enough for home power users. HDW Sec conducts vulnerability research on connected objects (routers, cameras, printers, etc.), and one client mission was to determine whether it was possible to compromise a selection of embedded devices, including this Nighthawk router.

A global memory corruption vulnerability exists in the upnpd server (the UPnP daemon shipped in /usr/sbin/upnpd on the router). A specially-crafted SUBSCRIBE request can lead to a stack buffer overflow, allowing an attacker to modify the execution flow toward an arbitrary address in the memory of the upnpd process. The flaw can be exploited without authentication, from the WAN or the LAN, and leads to remote code execution (a root shell on the device). It is tracked as PSV-2022-0155 / CVE-2022-48322.

Issue(s)

• Pre-authentication stack-based buffer overflow in the upnpd UPnP daemon, reachable from both WAN and LAN.
• The overflow chains through three primitives:
  • A stack buffer overflow in sub_2A021AE0() because sprintf() does not check the size of the global variable defaultIPConnectionServiceType.
  • defaultIPConnectionServiceType can be rewritten with a larger size by overflowing the preceding global variable.
  • That preceding global variable is an array of structures, and it can itself be overflowed via oversized SUBSCRIBE data.
• Successful exploitation yields arbitrary command execution as root, which can subsequently give access to third-party subnets.

Full technical analysis

The complete write-up (root cause, exploitation, proof of concept) is available on the HDW Sec blog: https://www.hdwsec.fr/blog/20230201-netgear/

References

• HDW Sec blog: https://www.hdwsec.fr/blog/20230201-netgear/
• CVE-2022-48322 (NVD): https://nvd.nist.gov/vuln/detail/CVE-2022-48322