CVE-2021-27239

8.8 highEPSS 0.8%

High (8.8) in netgear. EPSS 0.8% chance of exploitation in the next 30 days.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the upnpd service, which listens on UDP port 1900 by default. A crafted MX header field in an SSDP message can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11851.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-121
Published: 2021-03-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

netgear:d6220_firmware
netgear:d6400_firmware
netgear:d7000_firmware
netgear:d8500_firmware
netgear:dc112a_firmware
netgear:ex7000_firmware
netgear:ex7500_firmware
netgear:r6250_firmware
netgear:r6300_firmware
netgear:r6400_firmware
netgear:r6700_firmware
netgear:r6900p_firmware
netgear:r7000_firmware
netgear:r7000p_firmware
netgear:r7100lg_firmware
netgear:r7850_firmware
netgear:r7900_firmware
netgear:r7900p_firmware
netgear:r7960p_firmware
netgear:r8000_firmware
netgear:r8000p_firmware
netgear:r8300_firmware
netgear:r8500_firmware
netgear:rax200_firmware
netgear:rax75_firmware
netgear:rax80_firmware
netgear:rbr750_firmware
netgear:rbr850_firmware
netgear:rbs40v_firmware
netgear:rbs750_firmware
netgear:rbs850_firmware
netgear:rs400_firmware
netgear:wndr3400_firmware
netgear:wnr3500l_firmware
netgear:xr300_firmware

References

Check your stack JSON