CVE-2020-28041
The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern…
Does this matter?
Lower severity and a low EPSS score (2.00%). Track it; it rarely justifies an emergency change on its own.
Description
The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs because the ALG takes action based on an IP packet with an initial REGISTER substring in the TCP data, and the correct intranet IP address in the subsequent Via header, without properly considering that connection progress and fragmentation affect the meaning of the packet data.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 2.00% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-276
- Affected
- netgear/nighthawk r7000 firmware
- Source
- cve@mitre.org
References
- https://github.com/samyk/slipstreamThird Party Advisory
- https://news.ycombinator.com/item?id=24956616Exploit, Third Party Advisory
- https://news.ycombinator.com/item?id=24958281Exploit, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0024Third Party Advisory
- https://samy.pl/slipstream/Exploit, Third Party Advisory
- https://github.com/samyk/slipstreamThird Party Advisory
- https://news.ycombinator.com/item?id=24956616Exploit, Third Party Advisory
- https://news.ycombinator.com/item?id=24958281Exploit, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0024Third Party Advisory
- https://samy.pl/slipstream/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.