CVE-2023-38925

Deeper analysis

Netgear devices including the DC112A running firmware 1.0.0.64, the EX6200 at 1.0.3.94, and the R6300v2 at 1.0.4.8 contain a buffer overflow in the http_passwd parameter processed by password.cgi. The flaw is tracked as CWE-120 and carries a CVSS 3.1 score of 8.8, reflecting network-reachable exploitation that requires only low privileges and no user interaction.

An authenticated attacker can supply an oversized value to the affected parameter and trigger memory corruption, resulting in arbitrary code execution with full control over the device’s confidentiality, integrity, and availability. Because the vulnerable endpoint is reachable over the network, the attack can be launched remotely once valid credentials are obtained.

Public references point to Netgear’s security disclosure page and a technical write-up containing proof-of-concept details. The current EPSS score of 0.2957 matches its recorded peak, indicating sustained but not sharply increasing exploitation interest since disclosure.