CVE-2020-9373 — Netgear R6400 upnpd Stack Overflow Research

A complete three-phase study of the historical Netgear R6400 router vulnerability CVE-2020-9373 (UPnP upnpd stack buffer overflow, SSDP on UDP port 1900, unauthenticated RCE/DoS).

Three Phases

1. Phase 1 · Reproduction: firmware unpacking → disassembly to locate the vulnerable point strcpy@0x222c8 → local QEMU emulation
2. Phase 2 · Hunting: assuming the vulnerability location is unknown, use static analysis to re-locate it (recvfrom → sub_22270 → strcpy data flow)
3. Phase 3 · Automation: distill the lessons learned into a reusable Agent workflow (firmware_audit.py)

Directory Structure

Path	Description
.claude/skills/	Claude Code Skills: firmware-unpack / vuln-repro / vuln-hunt / firmware-audit
reports/	Firmware structure summary, Phase 1/2/3 reports, auto-generated vulnerability analysis report
firmware_audit.py	Automated firmware vulnerability static analysis script (unpacking → entry-point identification → dangerous-function enumeration → report)
poc_ssdp_crash.py	Crash PoC (oversized M-SEARCH triggers stack overflow)
setup-tools.sh	One-click installation of the WSL2 firmware analysis toolchain
CLAUDE.md	Project conventions and security boundaries

Environment

• WSL2 Ubuntu + binwalk / squashfs-tools / qemu-arm-static / gdb-multiarch / pwntools
• Target firmware: R6400-V1.0.1.52_1.0.36.chk (must be downloaded manually from the Netgear official website/mirror; not included in the repository)

Vulnerability Summary

• Component: upnpd (UPnP daemon)
• Type: stack buffer overflow (strcpy with no length validation)
• Attack surface: UDP 1900, SSDP M-SEARCH
• Architecture: ARM 32-bit little-endian, uClibc

Security Disclaimer

This project is for authorized security research only in local/QEMU environments; sending requests to any public-internet target is prohibited.