PT-2020-8311 · NetGear · R7000P+12

Published 2020-04-22 · Updated 2020-04-24 · CVE-2017-18762

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: D3600 versions prior to 1.0.0.68 D6000 versions prior to 1.0.0.68 D6100 versions prior to 1.0.0.57 R6100 versions prior to 1.0.1.16 R6900P versions prior to 1.2.0.22 R7000 versions prior to 1.0.9.10 R7000P versions prior to 1.2.0.22 R7100LG versions prior to 1.0.0.40 WNDR3700v4 versions prior to 1.0.2.88 WNDR4300v1 versions prior to 1.0.2.90 WNDR4300v2 versions prior to 1.0.0.48 WNDR4500v3 versions prior to 1.0.0.48 WNR2000v5 versions prior to 1.0.0.58

Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.

Recommendations: For D3600 versions prior to 1.0.0.68, update to version 1.0.0.68 or later. For D6000 versions prior to 1.0.0.68, update to version 1.0.0.68 or later. For D6100 versions prior to 1.0.0.57, update to version 1.0.0.57 or later. For R6100 versions prior to 1.0.1.16, update to version 1.0.1.16 or later. For R6900P versions prior to 1.2.0.22, update to version 1.2.0.22 or later. For R7000 versions prior to 1.0.9.10, update to version 1.0.9.10 or later. For R7000P versions prior to 1.2.0.22, update to version 1.2.0.22 or later. For R7100LG versions prior to 1.0.0.40, update to version 1.0.0.40 or later. For WNDR3700v4 versions prior to 1.0.2.88, update to version 1.0.2.88 or later. For WNDR4300v1 versions prior to 1.0.2.90, update to version 1.0.2.90 or later. For WNDR4300v2 versions prior to 1.0.0.48, update to version 1.0.0.48 or later. For WNDR4500v3 versions prior to 1.0.0.48, update to version 1.0.0.48 or later. For WNR2000v5 versions prior to 1.0.0.58, update to version 1.0.0.58 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-18762

Affected Products

D3600

D6000

D6100

R6100

R6900P

R7000

R7000P

R7100Lg

Wndr3700V4

Wndr4300V1

Wndr4300V2

Wndr4500V3

Wnr2000V5

References · 5

• https://osv.dev/vulnerability/CVE-2017-18762 · Vendor Advisory
• https://kb.netgear.com/000051483/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2017-2451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18762 · Security Note
• https://t.me/cibsecurity/11537 · Telegram Post
• https://t.me/cvenotify/3031 · Telegram Post