Netgear CVE-2025-6565

This vulnerability presents substantial real-world risk despite requiring authentication (PR:L in CVSS vector). Multiple risk signals align: (1) CVSS 8.8 reflects high severity with network-accessible attack surface (AV:N), low complexity (AC:L), and complete confidentiality/integrity/availability impact (C:H/I:H/A:H); (2) Public POC availability dramatically increases exploitation probability and reduces attacker skill barrier; (3) KEV status indicates active exploitation or disclosure sufficient for prioritization; (4) Authentication requirement (PR:L) is a mitigating factor but many WNCE3001 devices use default credentials, rendering this effectively unauthenticated; (5) The stack-based nature suggests high reliability of exploitation with minimal environmental variance. Per SSVC framework: exploitation is PoC-available/public, automatable (no user interaction required), and technical impact is complete system compromise. This is a genuine priority for organizations with WNCE3001 deployments.

An attacker on the same network or with network access to a vulnerable WNCE3001 device authenticates using default credentials (admin/password) or via credential stuffing. The attacker crafts a malicious HTTP POST request with an oversized Host header (e.g., 500+ bytes) to the device's web interface. This overflows the fixed-size stack buffer in http_d, overwriting the function return address with a pointer to attacker-controlled shellcode (possibly injected via the same request or pre-positioned in memory). Upon function return, execution jumps to attacker code running with root privileges (typical for embedded web servers). The attacker establishes persistence (e.g., installing backdoor in firmware) and pivots to other devices on the network, using the extender as a beachhead. Public POC likely demonstrates crashing the service (DoS) at minimum and may include RCE payload; exploitation requires only basic HTTP client tools (curl, Burp Suite) and knowledge of the device's default IP (192.168.1.1 typical).