Xarkes

This issue allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR routers. Authentication is not required to exploit this issue. The specific flaw exists within the downloading of files via HTTPS, resulting from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other issues to execute arbitrary code in the context of root.

This issue allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR routers. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the `circled` daemon. A crafted `circleinfo.txt` file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of `root`.