PT-2020-10667 · NetGear · Ex3700+34

Aircut · Published 2020-04-16 · Updated 2020-04-23 · CVE-2019-20692

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR D6220 versions 1.0.0.1 through 1.0.0.43 NETGEAR D6400 versions 1.0.0.1 through 1.0.0.77 NETGEAR D7000v2 versions 1.0.0.1 through 1.0.0.50 NETGEAR D8500 versions 1.0.0.1 through 1.0.3.41 NETGEAR DGN2200v4 versions 1.0.0.1 through 1.0.0.109 NETGEAR DGND2200Bv4 versions 1.0.0.1 through 1.0.0.108 NETGEAR EX3700 versions 1.0.0.1 through 1.0.0.69 NETGEAR EX3800 versions 1.0.0.1 through 1.0.0.69 NETGEAR EX6000 versions 1.0.0.1 through 1.0.0.29 NETGEAR EX6100 versions 1.0.0.1 through 1.0.2.23 NETGEAR EX6120 versions 1.0.0.1 through 1.0.0.39 NETGEAR EX6130 versions 1.0.0.1 through 1.0.0.21 NETGEAR EX6150v1 versions 1.0.0.1 through 1.0.0.41 NETGEAR EX6200 versions 1.0.0.1 through 1.0.3.87 NETGEAR EX7000 versions 1.0.0.1 through 1.0.0.65 NETGEAR R6250 versions 1.0.0.1 through 1.0.4.25 NETGEAR R6300v2 versions 1.0.0.1 through 1.0.4.27 NETGEAR R6400 versions 1.0.0.1 through 1.0.1.35 NETGEAR R6400v2 versions 1.0.0.1 through 1.0.2.51 NETGEAR R6700 versions 1.0.0.1 through 1.0.1.45 NETGEAR R6900 versions 1.0.0.1 through 1.0.1.45 NETGEAR R7000 versions 1.0.0.1 through 1.0.9.27 NETGEAR R6900P versions 1.0.0.1 through 1.3.1.43 NETGEAR R7000P versions 1.0.0.1 through 1.3.1.43 NETGEAR R7100LG versions 1.0.0.1 through 1.0.0.45 NETGEAR R7300DST versions 1.0.0.1 through 1.0.0.67 NETGEAR R7900 versions 1.0.0.1 through 1.0.2.9 NETGEAR R8000 versions 1.0.0.1 through 1.0.4.11 NETGEAR R7900P versions 1.0.0.1 through 1.3.0.9 NETGEAR R8000P versions 1.0.0.1 through 1.3.0.9 NETGEAR R8300 versions 1.0.0.1 through 1.0.2.121 NETGEAR R8500 versions 1.0.0.1 through 1.0.2.121 NETGEAR WN2500RPv2 versions 1.0.0.1 through 1.0.1.53 NETGEAR WNDR3400v3 versions 1.0.0.1 through 1.0.1.21 NETGEAR WNR3500Lv2 versions 1.0.0.1 through 1.2.0.53

Description A stack-based buffer overflow issue affects certain NETGEAR devices, allowing an unauthenticated attacker to exploit the vulnerability.

Recommendations Update NETGEAR D6220 to version 1.0.0.44 or later Update NETGEAR D6400 to version 1.0.0.78 or later Update NETGEAR D7000v2 to version 1.0.0.51 or later Update NETGEAR D8500 to version 1.0.3.42 or later Update NETGEAR DGN2200v4 to version 1.0.0.110 or later Update NETGEAR DGND2200Bv4 to version 1.0.0.109 or later Update NETGEAR EX3700 to version 1.0.0.70 or later Update NETGEAR EX3800 to version 1.0.0.70 or later Update NETGEAR EX6000 to version 1.0.0.30 or later Update NETGEAR EX6100 to version 1.0.2.24 or later Update NETGEAR EX6120 to version 1.0.0.40 or later Update NETGEAR EX6130 to version 1.0.0.22 or later Update NETGEAR EX6150v1 to version 1.0.0.42 or later Update NETGEAR EX6200 to version 1.0.3.88 or later Update NETGEAR EX7000 to version 1.0.0.66 or later Update NETGEAR R6250 to version 1.0.4.26 or later Update NETGEAR R6300v2 to version 1.0.4.28 or later Update NETGEAR R6400 to version 1.0.1.36 or later Update NETGEAR R6400v2 to version 1.0.2.52 or later Update NETGEAR R6700 to version 1.0.1.46 or later Update NETGEAR R6900 to version 1.0.1.46 or later Update NETGEAR R7000 to version 1.0.9.28 or later Update NETGEAR R6900P to version 1.3.1.44 or later Update NETGEAR R7000P to version 1.3.1.44 or later Update NETGEAR R7100LG to version 1.0.0.46 or later Update NETGEAR R7300DST to version 1.0.0.68 or later Update NETGEAR R7900 to version 1.0.2.10 or later Update NETGEAR R8000 to version 1.0.4.12 or later Update NETGEAR R7900P to version 1.3.0.10 or later Update NETGEAR R8000P to version 1.3.0.10 or later Update NETGEAR R8300 to version 1.0.2.122 or later Update NETGEAR R8500 to version 1.0.2.122 or later Update NETGEAR WN2500RPv2 to version 1.0.1.54 or later Update NETGEAR WNDR3400v3 to version 1.0.1.22 or later Update NETGEAR WNR3500Lv2 to version 1.2.0.54 or later

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-20692

Affected Products

D6220

D6400

D7000V2

D8500

Dgn2200V4

Dgnd2200Bv4

Ex3700

Ex3800

Ex6000

Ex6100

Ex6120

Ex6130

Ex6150V1

Ex6200

Ex7000

R6250

R6300V2

R6400

R6400V2

R6700

R6900

R6900P

R7000

R7000P

R7100Lg

R7300Dst

R7900

R7900P

R8000

R8000P

R8300

R8500

Wn2500Rpv2

Wndr3400V3

Wnr3500Lv2

References · 3

• https://osv.dev/vulnerability/CVE-2019-20692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20692 · Security Note
• https://kb.netgear.com/000061447/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2014 · Vendor Advisory