PT-2020-10709 · NetGear · Ex3700+26

Published 2020-04-16 · Updated 2020-05-05 · CVE-2019-20734

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions D6220 versions 1.0.0.0 through 1.0.0.39 D8500 versions 1.0.0.0 through 1.0.3.38 EX3700 versions 1.0.0.0 through 1.0.0.69 EX3800 versions 1.0.0.0 through 1.0.0.69 EX6000 versions 1.0.0.0 through 1.0.0.29 EX6100 versions 1.0.0.0 through 1.0.2.21 EX6120 versions 1.0.0.0 through 1.0.0.39 EX6130 versions 1.0.0.0 through 1.0.0.21 EX6150v1 versions 1.0.0.0 through 1.0.0.41 EX6200 versions 1.0.0.0 through 1.0.3.87 EX7000 versions 1.0.0.0 through 1.0.0.65 R6300v2 versions 1.0.0.0 through 1.0.4.17 R6400 versions 1.0.0.0 through 1.0.1.23 R6400v2 versions 1.0.0.0 through 1.0.2.31 R6700 versions 1.0.0.0 through 1.0.1.21 R6700v3 versions 1.0.0.0 through 1.0.2.31 R6900 versions 1.0.0.0 through 1.0.1.21 R7000 versions 1.0.0.0 through 1.0.9.5 R6900P versions 1.0.0.0 through 1.0.0.55 R7000P versions 1.0.0.0 through 1.0.0.55 R7100LG versions 1.0.0.0 through 1.0.0.41 R7300DST versions 1.0.0.0 through 1.0.0.53 R7900 versions 1.0.0.0 through 1.0.1.25 R8300 versions 1.0.0.0 through 1.0.2.105 R8500 versions 1.0.0.0 through 1.0.2.105 WN2500RPv2 versions 1.0.0.0 through 1.0.1.53 WNR3500Lv2 versions 1.0.0.0 through 1.2.0.45

Description Certain NETGEAR devices are affected by a buffer overflow that can be exploited by an unauthenticated attacker.

Recommendations Update D6220 to version 1.0.0.40 or later. Update D8500 to version 1.0.3.39 or later. Update EX3700 to version 1.0.0.70 or later. Update EX3800 to version 1.0.0.70 or later. Update EX6000 to version 1.0.0.30 or later. Update EX6100 to version 1.0.2.22 or later. Update EX6120 to version 1.0.0.40 or later. Update EX6130 to version 1.0.0.22 or later. Update EX6150v1 to version 1.0.0.42 or later. Update EX6200 to version 1.0.3.88 or later. Update EX7000 to version 1.0.0.66 or later. Update R6300v2 to version 1.0.4.18 or later. Update R6400 to version 1.0.1.24 or later. Update R6400v2 to version 1.0.2.32 or later. Update R6700 to version 1.0.1.22 or later. Update R6700v3 to version 1.0.2.32 or later. Update R6900 to version 1.0.1.22 or later. Update R7000 to version 1.0.9.6 or later. Update R6900P to version 1.0.0.56 or later. Update R7000P to version 1.0.0.56 or later. Update R7100LG to version 1.0.0.42 or later. Update R7300DST to version 1.0.0.54 or later. Update R7900 to version 1.0.1.26 or later. Update R8300 to version 1.0.2.106 or later. Update R8500 to version 1.0.2.106 or later. Update WN2500RPv2 to version 1.0.1.54 or later. Update WNR3500Lv2 to version 1.2.0.46 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2019-20734

Affected Products

D6220

D8500

Ex3700

Ex3800

Ex6000

Ex6100

Ex6120

Ex6130

Ex6150V1

Ex6200

Ex7000

R6300V2

R6400

R6400V2

R6700

R6700V3

R6900

R6900P

R7000

R7000P

R7100Lg

R7300Dst

R7900

R8300

R8500

Wn2500Rpv2

Wnr3500Lv2

References · 4

• https://osv.dev/vulnerability/CVE-2019-20734 · Vendor Advisory
• https://kb.netgear.com/000061192/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0791 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20734 · Security Note
• https://t.me/cvenotify/2862 · Telegram Post