CVE-2022-27643

Deeper analysis

This vulnerability is a pre-authentication buffer overflow (CWE-120) in the SOAP request handler of NETGEAR R6700v3 routers running firmware 1.0.4.120_10.0.91. When processing the SOAPAction header, the affected code copies user-supplied data into a fixed-size buffer without validating its length, enabling an attacker to overwrite memory and execute arbitrary code.

Network-adjacent attackers can exploit the flaw without authentication or user interaction. Successful exploitation grants code execution in the root context, allowing an attacker to take full control of the device, including altering configuration, intercepting traffic, or using the router as a pivot point inside the local network.

NETGEAR has published security advisory PSV-2021-0323 addressing the issue across multiple affected products, while the Zero Day Initiative has released details under ZDI-22-519 (originally ZDI-CAN-15692). The advisories point administrators to vendor-supplied firmware updates that correct the improper length check.

The EPSS score rose from a low baseline to a peak of 0.0551 on 2026-02-03 before receding to the current value of 0.0084, indicating a measurable increase in observed exploitation interest after public disclosure.