PT-2020-8321 · NetGear · Netgear Ex3800+12

Maxime Peterlin · Published 2020-04-22 · Updated 2020-04-24 · CVE-2017-18772

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: NETGEAR EX3700 versions prior to 1.0.0.64 NETGEAR EX3800 versions prior to 1.0.0.64 NETGEAR EX6120 versions prior to 1.0.0.32 NETGEAR EX6130 versions prior to 1.0.0.16 NETGEAR R6300v2 versions prior to 1.0.4.12 NETGEAR R6700 versions prior to 1.0.1.26 NETGEAR R6900 versions prior to 1.0.1.22 NETGEAR R7000 versions prior to 1.0.9.6 NETGEAR R7300DST versions prior to 1.0.0.52 NETGEAR R7900 versions prior to 1.0.1.12 NETGEAR R8000 versions prior to 1.0.3.24 NETGEAR R8500 versions prior to 1.0.2.74 NETGEAR WNR2000v2 versions prior to 1.2.0.8

Description: The issue is related to authentication bypass, affecting various NETGEAR devices.

Recommendations: For NETGEAR EX3700 versions prior to 1.0.0.64, update to version 1.0.0.64 or later. For NETGEAR EX3800 versions prior to 1.0.0.64, update to version 1.0.0.64 or later. For NETGEAR EX6120 versions prior to 1.0.0.32, update to version 1.0.0.32 or later. For NETGEAR EX6130 versions prior to 1.0.0.16, update to version 1.0.0.16 or later. For NETGEAR R6300v2 versions prior to 1.0.4.12, update to version 1.0.4.12 or later. For NETGEAR R6700 versions prior to 1.0.1.26, update to version 1.0.1.26 or later. For NETGEAR R6900 versions prior to 1.0.1.22, update to version 1.0.1.22 or later. For NETGEAR R7000 versions prior to 1.0.9.6, update to version 1.0.9.6 or later. For NETGEAR R7300DST versions prior to 1.0.0.52, update to version 1.0.0.52 or later. For NETGEAR R7900 versions prior to 1.0.1.12, update to version 1.0.1.12 or later. For NETGEAR R8000 versions prior to 1.0.3.24, update to version 1.0.3.24 or later. For NETGEAR R8500 versions prior to 1.0.2.74, update to version 1.0.2.74 or later. For NETGEAR WNR2000v2 versions prior to 1.2.0.8, update to version 1.2.0.8 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-18772

Affected Products

Netgear Ex3700

Netgear Ex3800

Netgear Ex6120

Netgear Ex6130

Netgear R6300V2

Netgear R6700

Netgear R6900P

Netgear R7000

Netgear R7300Dst

Netgear R7900

Netgear R8000

Netgear R8500

Netgear Wnr2000V2

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-18772 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18772 · Vendor Advisory
• https://kb.netgear.com/000051471/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-Extenders-PSV-2017-0424 · Vendor Advisory
• https://t.me/cvenotify/3010 · Telegram Post
• https://t.me/cibsecurity/11524 · Telegram Post