PT-2023-26689 · NetGear · Netgear R6300V2+2

CVE-2023-38925 · Publicado 2023-08-07 · Atualizado 2023-08-09

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netgear DC112A version 1.0.0.64 Netgear EX6200 version 1.0.3.94 Netgear R6300v2 version 1.0.4.8

Description A buffer overflow issue was discovered via the http passwd parameter in password.cgi. This issue affects Netgear devices.

Recommendations For Netgear DC112A version 1.0.0.64, consider disabling access to the password.cgi until a patch is available. For Netgear EX6200 version 1.0.3.94, restrict the use of the http passwd parameter in the password.cgi to minimize the risk of exploitation. For Netgear R6300v2 version 1.0.4.8, avoid using the http passwd parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2023-38925

Produtos afetados

Netgear Dc112A

Netgear Ex6200

Netgear R6300V2

Referências · 5

• https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_smb_pass/README.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-38925 · Nota de Segurança
• https://t.me/cvenotify/55944 · Publicação no Telegram
• https://netgear.com/about/security · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-38925 · Aviso do Fabricante