PT-2020-10708 · NetGear · Ex3700+34

Aircut · Published 2020-04-16 · Updated 2020-04-23 · CVE-2019-20733

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR D6220 versions 1.0.0.0 through 1.0.0.43 NETGEAR D6400 versions 1.0.0.0 through 1.0.0.77 NETGEAR D7000v2 versions 1.0.0.0 through 1.0.0.50 NETGEAR D8500 versions 1.0.0.0 through 1.0.3.41 NETGEAR DGN2200v4 versions 1.0.0.0 through 1.0.0.109 NETGEAR DGND2200Bv4 versions 1.0.0.0 through 1.0.0.109 NETGEAR EX3700 versions 1.0.0.0 through 1.0.0.69 NETGEAR EX3800 versions 1.0.0.0 through 1.0.0.69 NETGEAR EX6000 versions 1.0.0.0 through 1.0.0.29 NETGEAR EX6100 versions 1.0.0.0 through 1.0.2.23 NETGEAR EX6120 versions 1.0.0.0 through 1.0.0.39 NETGEAR EX6130 versions 1.0.0.0 through 1.0.0.21 NETGEAR EX6150v1 versions 1.0.0.0 through 1.0.0.41 NETGEAR EX6200 versions 1.0.0.0 through 1.0.3.87 NETGEAR EX7000 versions 1.0.0.0 through 1.0.0.65 NETGEAR R6250 versions 1.0.0.0 through 1.0.4.25 NETGEAR R6300v2 versions 1.0.0.0 through 1.0.4.27 NETGEAR R6400 versions 1.0.0.0 through 1.0.1.35 NETGEAR R6400v2 versions 1.0.0.0 through 1.0.2.51 NETGEAR R6700 versions 1.0.0.0 through 1.0.1.45 NETGEAR R6900 versions 1.0.0.0 through 1.0.1.45 NETGEAR R7000 versions 1.0.0.0 through 1.0.9.27 NETGEAR R6900P versions 1.0.0.0 through 1.3.1.63 NETGEAR R7000P versions 1.0.0.0 through 1.3.1.63 NETGEAR R7100LG versions 1.0.0.0 through 1.0.0.45 NETGEAR R7300DST versions 1.0.0.0 through 1.0.0.67 NETGEAR R7900 versions 1.0.0.0 through 1.0.2.9 NETGEAR R8000 versions 1.0.0.0 through 1.0.4.11 NETGEAR R7900P versions 1.0.0.0 through 1.3.0.9 NETGEAR R8000P versions 1.0.0.0 through 1.3.0.9 NETGEAR R8300 versions 1.0.0.0 through 1.0.2.121 NETGEAR R8500 versions 1.0.0.0 through 1.0.2.121 NETGEAR WN2500RPv2 versions 1.0.0.0 through 1.0.1.53 NETGEAR WNDR3400v3 versions 1.0.0.0 through 1.0.1.21 NETGEAR WNR3500Lv2 versions 1.0.0.0 through 1.2.0.53

Description Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.

Recommendations For NETGEAR D6220 versions 1.0.0.0 through 1.0.0.43, update to version 1.0.0.44 or later. For NETGEAR D6400 versions 1.0.0.0 through 1.0.0.77, update to version 1.0.0.78 or later. For NETGEAR D7000v2 versions 1.0.0.0 through 1.0.0.50, update to version 1.0.0.51 or later. For NETGEAR D8500 versions 1.0.0.0 through 1.0.3.41, update to version 1.0.3.42 or later. For NETGEAR DGN2200v4 versions 1.0.0.0 through 1.0.0.109, update to version 1.0.0.110 or later. For NETGEAR DGND2200Bv4 versions 1.0.0.0 through 1.0.0.109, update to version 1.0.0.110 or later. For NETGEAR EX3700 versions 1.0.0.0 through 1.0.0.69, update to version 1.0.0.70 or later. For NETGEAR EX3800 versions 1.0.0.0 through 1.0.0.69, update to version 1.0.0.70 or later. For NETGEAR EX6000 versions 1.0.0.0 through 1.0.0.29, update to version 1.0.0.30 or later. For NETGEAR EX6100 versions 1.0.0.0 through 1.0.2.23, update to version 1.0.2.24 or later. For NETGEAR EX6120 versions 1.0.0.0 through 1.0.0.39, update to version 1.0.0.40 or later. For NETGEAR EX6130 versions 1.0.0.0 through 1.0.0.21, update to version 1.0.0.22 or later. For NETGEAR EX6150v1 versions 1.0.0.0 through 1.0.0.41, update to version 1.0.0.42 or later. For NETGEAR EX6200 versions 1.0.0.0 through 1.0.3.87, update to version 1.0.3.88 or later. For NETGEAR EX7000 versions 1.0.0.0 through 1.0.0.65, update to version 1.0.0.66 or later. For NETGEAR R6250 versions 1.0.0.0 through 1.0.4.25, update to version 1.0.4.26 or later. For NETGEAR R6300v2 versions 1.0.0.0 through 1.0.4.27, update to version 1.0.4.28 or later. For NETGEAR R6400 versions 1.0.0.0 through 1.0.1.35, update to version 1.0.1.36 or later. For NETGEAR R6400v2 versions 1.0.0.0 through 1.0.2.51, update to version 1.0.2.52 or later. For NETGEAR R6700 versions 1.0.0.0 through 1.0.1.45, update to version 1.0.1.46 or later. For NETGEAR R6900 versions 1.0.0.0 through 1.0.1.45, update to version 1.0.1.46 or later. For NETGEAR R7000 versions 1.0.0.0 through 1.0.9.27, update to version 1.0.9.28 or later. For NETGEAR R6900P versions 1.0.0.0 through 1.3.1.63, update to version 1.3.1.64 or later. For NETGEAR R7000P versions 1.0.0.0 through 1.3.1.63, update to version 1.3.1.64 or later. For NETGEAR R7100LG versions 1.0.0.0 through 1.0.0.45, update to version 1.0.0.46 or later. For NETGEAR R7300DST versions 1.0.0.0 through 1.0.0.67, update to version 1.0.0.68 or later. For NETGEAR R7900 versions 1.0.0.0 through 1.0.2.9, update to version 1.0.2.10 or later. For NETGEAR R8000 versions 1.0.0.0 through 1.0.4.11, update to version 1.0.4.12 or later. For NETGEAR R7900P versions 1.0.0.0 through 1.3.0.9, update to version 1.3.0.10 or later. For NETGEAR R8000P versions 1.0.0.0 through 1.3.0.9, update to version 1.3.0.10 or later. For NETGEAR R8300 versions 1.0.0.0 through 1.0.2.121, update to version 1.0.2.122 or later. For NETGEAR R8500 versions 1.0.0.0 through 1.0.2.121, update to version 1.0.2.122 or later. For NETGEAR WN2500RPv2 versions 1.0.0.0 through 1.0.1.53, update to version 1.0.1.54 or later. For NETGEAR WNDR3400v3 versions 1.0.0.0 through 1.0.1.21, update to version 1.0.1.22 or later. For NETGEAR WNR3500Lv2 versions 1.0.0.0 through 1.2.0.53, update to version 1.2.0.54 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-20733

Affected Products

D6220

D6400

D7000V2

D8500

Dgn2200V4

Dgnd2200Bv4

Ex3700

Ex3800

Ex6000

Ex6100

Ex6120

Ex6130

Ex6150V1

Ex6200

Ex7000

R6250

R6300V2

R6400

R6400V2

R6700

R6900

R6900P

R7000

R7000P

R7100Lg

R7300Dst

R7900

R7900P

R8000

R8000P

R8300

R8500

Wn2500Rpv2

Wndr3400V3

Wnr3500Lv2

References · 4

• https://osv.dev/vulnerability/CVE-2019-20733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20733 · Security Note
• https://kb.netgear.com/000061193/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2017 · Vendor Advisory
• https://t.me/cvenotify/2861 · Telegram Post