PT-2017-4192 · NetGear · Netgear Wnr2000V4+2

Published 2017-05-26 · Updated 2024-06-28 · CVE-2017-6862

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR WNR2000v3 versions prior to 1.1.2.14 NETGEAR WNR2000v4 versions prior to 1.0.0.66 NETGEAR WNR2000v5 versions prior to 1.0.0.42

Description The issue allows authentication bypass and remote code execution via a buffer overflow in the administration webapp. This is due to a parameter in the webapp that can be exploited. The vulnerability can be exploited by a remote attacker to execute arbitrary code.

Recommendations For NETGEAR WNR2000v3 versions prior to 1.1.2.14, update to version 1.1.2.14 or later. For NETGEAR WNR2000v4 versions prior to 1.0.0.66, update to version 1.0.0.66 or later. For NETGEAR WNR2000v5 versions prior to 1.0.0.42, update to version 1.0.0.42 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2022-03967

CVE-2017-6862

Affected Products

Netgear Wnr2000V3

Netgear Wnr2000V4

Netgear Wnr2000V5

References · 9

• https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6862 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03967 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-6862 · Security Note
• https://t.me/true_secator/3042 · Telegram Post
• http://securityfocus.com/bid/98740 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://on-x.com/sites/default/files/on-x_-_security_advisory_-_netgear_wnr2000v5_-_cve-2017-6862.pdf · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6862 · Note