CVE-2022-27646: NETGEAR CBR40 Firmware

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the circled daemon. A crafted circleinfo.txt file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15879.

Affected products

NETGEAR CBR40 Firmware: before 2.5.0.28 (fixed in 2.5.0.28)
NETGEAR LBR1020 Firmware: before 2.7.4.2 (fixed in 2.7.4.2)
NETGEAR LBR20 Firmware: before 2.7.4.2 (fixed in 2.7.4.2)
NETGEAR r6400 Firmware: before 1.0.4.126 (fixed in 1.0.4.126)
NETGEAR r6700 Firmware: before 1.0.4.126 (fixed in 1.0.4.126)
NETGEAR r6900p Firmware: before 1.3.3.148 (fixed in 1.3.3.148)
NETGEAR r7000 Firmware: before 1.0.11.134 (fixed in 1.0.11.134)
NETGEAR r7000p Firmware: before 1.3.3.148 (fixed in 1.3.3.148)
NETGEAR r7850 Firmware: before 1.0.5.84 (fixed in 1.0.5.84)
NETGEAR r7960p Firmware: before 1.4.3.88 (fixed in 1.4.3.88)
NETGEAR r8000 Firmware: before 1.0.4.84 (fixed in 1.0.4.84)
NETGEAR r8000p Firmware: before 1.4.3.88 (fixed in 1.4.3.88)
NETGEAR RAX200 Firmware: before 1.0.6.138 (fixed in 1.0.6.138)
NETGEAR RAX75 Firmware: before 1.0.6.138 (fixed in 1.0.6.138)
NETGEAR RAX80 Firmware: before 1.0.6.138 (fixed in 1.0.6.138)
NETGEAR RBR10 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RBR20 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RBR40 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RBR50 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RBS10 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RBS20 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RBS40 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RBS50 Firmware: before 2.7.4.24 (fixed in 2.7.4.24)
NETGEAR RS400 Firmware: before 1.5.1.86 (fixed in 1.5.1.86)

Published 2023-03-29. Last modified 2026-06-17.