PT-2020-10729 · NetGear · Jndr3000+28

Wayne Chin Yick Low · Published 2020-04-16 · Updated 2020-04-23 · CVE-2019-20754

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions DGN2200 versions 1.0.0.0 through 1.0.0.57 DGN2200B versions 1.0.0.0 through 1.0.0.57 D8500 versions 1.0.0.0 through 1.0.3.41 D7000v2 versions 1.0.0.0 through 1.0.0.50 D6400 versions 1.0.0.0 through 1.0.0.79 D6220 versions 1.0.0.0 through 1.0.0.43 EX7000 versions 1.0.0.0 through 1.0.0.65 EX6200 versions 1.0.0.0 through 1.0.3.87 EX6150 versions 1.0.0.0 through 1.0.0.41 EX7500 versions 1.0.0.0 through 1.0.0.45 JNDR3000 versions 1.0.0.0 through 1.0.0.23 R8000 versions 1.0.0.0 through 1.0.4.17 R8500 versions 1.0.0.0 through 1.0.2.121 R8300 versions 1.0.0.0 through 1.0.2.121 R7900P versions 1.0.0.0 through 1.4.0.9 R8000P versions 1.0.0.0 through 1.4.0.9 R7900 versions 1.0.0.0 through 1.0.2.15 R7000P versions 1.0.0.0 through 1.3.1.43 R7300DST versions 1.0.0.0 through 1.0.0.67 R7100LG versions 1.0.0.0 through 1.0.0.45 R6900P versions 1.0.0.0 through 1.3.1.43 R7000 versions 1.0.0.0 through 1.0.9.31 R6900 versions 1.0.0.0 through 1.0.1.45 R6700 versions 1.0.0.0 through 1.0.1.45 R6400v2 versions 1.0.0.0 through 1.0.2.55 R6400 versions 1.0.0.0 through 1.0.1.41 R6300v2 versions 1.0.0.0 through 1.0.4.27 R6250 versions 1.0.0.0 through 1.0.4.25 WNDR4500v2 versions 1.0.0.0 through 1.0.0.71 WNR3500Lv2 versions 1.0.0.0 through 1.2.0.53

Description A buffer overflow issue affects certain NETGEAR devices when an authenticated user exploits the vulnerability.

Recommendations Update DGN2200 to version 1.0.0.58 or later. Update DGN2200B to version 1.0.0.58 or later. Update D8500 to version 1.0.3.42 or later. Update D7000v2 to version 1.0.0.51 or later. Update D6400 to version 1.0.0.80 or later. Update D6220 to version 1.0.0.44 or later. Update EX7000 to version 1.0.0.66 or later. Update EX6200 to version 1.0.3.88 or later. Update EX6150 to version 1.0.0.42 or later. Update EX7500 to version 1.0.0.46 or later. Update JNDR3000 to version 1.0.0.24 or later. Update R8000 to version 1.0.4.18 or later. Update R8500 to version 1.0.2.122 or later. Update R8300 to version 1.0.2.122 or later. Update R7900P to version 1.4.0.10 or later. Update R8000P to version 1.4.0.10 or later. Update R7900 to version 1.0.2.16 or later. Update R7000P to version 1.3.1.44 or later. Update R7300DST to version 1.0.0.68 or later. Update R7100LG to version 1.0.0.46 or later. Update R6900P to version 1.3.1.44 or later. Update R7000 to version 1.0.9.32 or later. Update R6900 to version 1.0.1.46 or later. Update R6700 to version 1.0.1.46 or later. Update R6400v2 to version 1.0.2.56 or later. Update R6400 to version 1.0.1.42 or later. Update R6300v2 to version 1.0.4.28 or later. Update R6250 to version 1.0.4.26 or later. Update WNDR4500v2 to version 1.0.0.72 or later. Update WNR3500Lv2 to version 1.2.0.54 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2019-20754

Affected Products

D6220

D6400

D7000V2

D8500

Dgn2200B

Ex6150

Ex6200

Ex7000

Ex7500

Jndr3000

R6250

R6300V2

R6400

R6400V2

R6700

R6900

R6900P

R7000

R7000P

R7100Lg

R7300Dst

R7900

R7900P

R8000

R8000P

R8300

R8500

Wndr4500V2

Wnr3500Lv2

References · 3

• https://osv.dev/vulnerability/CVE-2019-20754 · Vendor Advisory
• https://kb.netgear.com/000060628/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Modem-Routers-and-Extenders-PSV-2018-0054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20754 · Security Note