PT-2020-8292 · NetGear · R6700+12

Published 2020-04-23 · Updated 2020-04-27 · CVE-2017-18743

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NETGEAR R6300v2 versions 1.0.0 through 1.0.4.7 NETGEAR R6400 versions 1.0.0 through 1.0.1.19 NETGEAR R6700 versions 1.0.0 through 1.0.1.19 NETGEAR R6900 versions 1.0.0 through 1.0.1.19 NETGEAR R7000 versions 1.0.0 through 1.0.7.9 NETGEAR R7100LG versions V1.0.0.0 through V1.0.0.31 NETGEAR R7300DST versions 1.0.0 through 1.0.0.51 NETGEAR R7900 versions 1.0.0 through 1.0.1.15 NETGEAR R8000 versions 1.0.0 through 1.0.3.35 NETGEAR R8300 versions 1.0.0 through 1.0.2.93 NETGEAR R8500 versions 1.0.0 through 1.0.2.93 NETGEAR WNDR3400v3 versions 1.0.0 through 1.0.1.11 NETGEAR WNR3500Lv2 versions 1.0.0 through 1.2.0.39

Description: Certain NETGEAR devices are affected by authentication bypass.

Recommendations: For R6300v2 versions 1.0.0 through 1.0.4.7, update to version 1.0.4.8 or later. For R6400 versions 1.0.0 through 1.0.1.19, update to version 1.0.1.20 or later. For R6700 versions 1.0.0 through 1.0.1.19, update to version 1.0.1.20 or later. For R6900 versions 1.0.0 through 1.0.1.19, update to version 1.0.1.20 or later. For R7000 versions 1.0.0 through 1.0.7.9, update to version 1.0.7.10 or later. For R7100LG versions V1.0.0.0 through V1.0.0.31, update to version V1.0.0.32 or later. For R7300DST versions 1.0.0 through 1.0.0.51, update to version 1.0.0.52 or later. For R7900 versions 1.0.0 through 1.0.1.15, update to version 1.0.1.16 or later. For R8000 versions 1.0.0 through 1.0.3.35, update to version 1.0.3.36 or later. For R8300 versions 1.0.0 through 1.0.2.93, update to version 1.0.2.94 or later. For R8500 versions 1.0.0 through 1.0.2.93, update to version 1.0.2.94 or later. For WNDR3400v3 versions 1.0.0 through 1.0.1.11, update to version 1.0.1.12 or later. For WNR3500Lv2 versions 1.0.0 through 1.2.0.39, update to version 1.2.0.40 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-18743

Affected Products

R6300V2

R6400

R6700

R6900

R7000

R7100Lg

R7300Dst

R7900

R8000

R8300

R8500

Wndr3400V3

Wnr3500Lv2

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-18743 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18743 · Vendor Advisory
• https://kb.netgear.com/000051512/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0330 · Vendor Advisory
• https://t.me/cibsecurity/11583 · Telegram Post
• https://t.me/cvenotify/3109 · Telegram Post