## https://sploitus.com/exploit?id=A0DAB749-866E-54FB-9EEC-FEF3169446B9
# CVE-2020-9373 – Netgear R6400 UPnP `upnpd` stack overflow vulnerability research
A comprehensive three-phase study of the historical vulnerability **CVE-2020-9373** in the Netgear R6400 router’s UPnP `upnpd` stack. This vulnerability involves a stack buffer overflow, triggered by an SSDP request on UDP port 1900, without authentication, resulting in a remote code execution (RCE) or denial-of-service (DoS) attack.
## Three Phases
1. **Phase 1: Reproduction** – Unpacking the firmware, identifying the vulnerable code at `strcpy@0x222c8`, and performing local emulation using QEMU.
2. **Phase 2: Analysis** – Assuming the location of the unknown vulnerability, re-evaluating the analysis using static analysis techniques (e.g., analyzing data flow from `recvfrom` to `sub_22270` to `strcpy`).
3. **Phase 3: Automation** – Turning the findings into a reusable agent workflow (`firmware_audit.py`).
## Directory Structure
| Path | Description |
|----|------------|
| `.claude/skills/` | Claude code skills: `firmware-unpack`, `vuln-repro`, `vuln-hunt`, `firmware-audit` |
| `reports/` | Summaries of firmware structures, reports for Phases 1/2/3, and automatically generated vulnerability analyses |
| `firmware_audit.py` | An automated script for static analysis of firmware vulnerabilities (unpacking, identifying entry points, enumerating dangerous functions, generating reports) |
| `poc_ssdp_crash.py` | A crash PoC that triggers a stack overflow due to an excessively long M-SEARCH request |
| `setup-tools.sh` | A one-click installation of the WSL2 firmware analysis toolchain |
| `CLAUDE.md` | Project conventions and security boundaries |
## Environment
- WSL2 Ubuntu + `binwalk`, `squashfs-tools`, `qemu-arm-static`, `gdb-multiarch`, `pwntools`
- Target firmware: `R6400-V1.0.1.52_1.0.36.chk` (To be downloaded from Netgear’s official website/mirror; not included in the repository)
## Vulnerability Summary
- Component: `upnpd` (UPnP daemon)
- Type: Stack buffer overflow (`strcpy` function not checking input length)
- Attack vector: UDP port 1900, SSDP `M-SEARCH` request
- Architecture: ARM 32-bit little-endian, uClibc
## Security Statement
This project is solely for authorized security research in local/QEMU environments. Requests targeting public networks are prohibited.