CVE-2020-27861 [High] | Command Injection in Cbk40 Firmware

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	1.02%	2.03%	+1.01%
2	2026-01-20	0.12%	1.02%	+0.90%
3	2025-11-21	—	0.12%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

1.02%

2.03%

+1.01%

2026-01-20

0.12%

1.02%

+0.90%

2025-11-21

—

0.12%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
8.8	3.1	HIGH	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	2.8	5.9	[email protected]
8.8	3.0	HIGH	`CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:A) Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	2.8	5.9	[email protected]
8.3	2.0	HIGH	`AV:A/AC:L/Au:N/C:C/I:C/A:C` Click to expand Access vector (AV:A) Requires access to an adjacent network segment. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:C) Complete confidentiality impact. Integrity impact (I:C) Complete integrity impact. Availability impact (A:C) Complete availability impact.	6.5	10.0	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

8.8

3.1

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

2.8

5.9

[email protected]

8.8

3.0

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:A): Attacker has to be nearby on the network—same office, same link, that vibe—not the whole wide internet.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

2.8

5.9

[email protected]

8.3

2.0

HIGH

AV:A/AC:L/Au:N/C:C/I:C/A:C Click to expand

Access vector (AV:A): Requires access to an adjacent network segment.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:C): Complete confidentiality impact.
Integrity impact (I:C): Complete integrity impact.
Availability impact (A:C): Complete availability impact.

6.5

10.0

[email protected]

Affected software / configurations for CVE-2020-27861

Vendor	Product	Version	Raw CPE
netgear	cbk40_firmware	< 2.6.1.38	cpe:2.3:o:netgear:cbk40_firmware::::::::
netgear	cbk43_firmware	< 2.6.1.38	cpe:2.3:o:netgear:cbk43_firmware::::::::
netgear	cbr40_firmware	< 2.6.1.38	cpe:2.3:o:netgear:cbr40_firmware::::::::
netgear	ex6200_firmware	< 1.0.1.82	cpe:2.3:o:netgear:ex6200_firmware::::::::
netgear	ex7700_firmware	< 1.0.0.210	cpe:2.3:o:netgear:ex7700_firmware::::::::
netgear	ex8000_firmware	< 1.0.1.224	cpe:2.3:o:netgear:ex8000_firmware::::::::
netgear	rbk12_firmware	< 2.6.1.44	cpe:2.3:o:netgear:rbk12_firmware::::::::
netgear	rbk13_firmware	< 2.6.1.44	cpe:2.3:o:netgear:rbk13_firmware::::::::
netgear	rbk14_firmware	< 2.6.1.44	cpe:2.3:o:netgear:rbk14_firmware::::::::
netgear	rbk15_firmware	< 2.6.1.44	cpe:2.3:o:netgear:rbk15_firmware::::::::
netgear	rbr10_firmware	< 2.6.1.44	cpe:2.3:o:netgear:rbr10_firmware::::::::
netgear	rbs10_firmware	< 2.6.1.44	cpe:2.3:o:netgear:rbs10_firmware::::::::
netgear	rbk20w_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk20w_firmware::::::::
netgear	rbk23w_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk23w_firmware::::::::
netgear	rbk20_router_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk20_router_firmware::::::::
netgear	rbk20_satellite_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbk20_satellite_firmware::::::::
netgear	rbk22_router_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk22_router_firmware::::::::
netgear	rbk22_satellite_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbk22_satellite_firmware::::::::
netgear	rbk23_router_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk23_router_firmware::::::::
netgear	rbk23_satellite_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbk23_satellite_firmware::::::::
netgear	rbr20_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbr20_firmware::::::::
netgear	rbs20_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbs20_firmware::::::::
netgear	rbk30_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk30_firmware::::::::
netgear	rbk33_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk33_firmware::::::::
netgear	rbk40_router_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk40_router_firmware::::::::
netgear	rbk40_satellite_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbk40_satellite_firmware::::::::
netgear	rbk43_router_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk43_router_firmware::::::::
netgear	rbk43_satellite_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbk43_satellite_firmware::::::::
netgear	rbk43s_router_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk43s_router_firmware::::::::
netgear	rbk43s_satellite_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbk43s_satellite_firmware::::::::
netgear	rbk44_router_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbk44_router_firmware::::::::
netgear	rbk44_satellite_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbk44_satellite_firmware::::::::
netgear	rbr40_firmware	< 2.6.1.36	cpe:2.3:o:netgear:rbr40_firmware::::::::
netgear	rbs40_firmware	< 2.6.1.38	cpe:2.3:o:netgear:rbs40_firmware::::::::
netgear	rbk50_firmware	< 2.6.1.40	cpe:2.3:o:netgear:rbk50_firmware::::::::
netgear	rbk50v_firmware	< 2.6.1.40	cpe:2.3:o:netgear:rbk50v_firmware::::::::
netgear	rbk52w_firmware	< 2.6.1.40	cpe:2.3:o:netgear:rbk52w_firmware::::::::
netgear	rbr50_firmware	< 2.6.1.40	cpe:2.3:o:netgear:rbr50_firmware::::::::
netgear	rbs50_firmware	< 2.6.1.40	cpe:2.3:o:netgear:rbs50_firmware::::::::

References for CVE-2020-27861

URL	Tags
https://kb.netgear.com/000062507/Security-Advisory-for-Unauthenticated-Command-Injection-Vulnerability-on-Some-Extenders-and-Orbi-WiFi-Systems	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1430/	Third Party Advisory VDB Entry

URL

CVE-2020-27861

Exploit prediction scoring system (EPSS) score for CVE-2020-27861

Common vulnerability scoring system (CVSS) metrics for CVE-2020-27861

Weakness enumeration for CVE-2020-27861

Affected software / configurations for CVE-2020-27861

References for CVE-2020-27861