PT-2020-8322 · NetGear · Ex6150V2+10

Published 2020-04-22 · Updated 2020-04-24 · CVE-2017-18773

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NETGEAR D6100 versions prior to V1.0.0.55 NETGEAR D7800 versions prior to V1.0.1.24 NETGEAR EX6150v2 versions prior to 1.0.0.48 NETGEAR R6100 versions prior to 1.0.1.14 NETGEAR R7500 versions prior to 1.0.0.110 NETGEAR R7500v2 versions prior to V1.0.3.16 NETGEAR R7800 versions prior to V1.0.2.36 NETGEAR WNDR4300v1 versions prior to 1.0.2.90 NETGEAR WNDR4300v2 versions prior to 1.0.0.48 NETGEAR WNDR4500v3 versions prior to 1.0.0.48 NETGEAR WNR2000v5 versions prior to 1.0.0.48

Description: The issue is related to command injection by an authenticated user. This allows an attacker to execute arbitrary commands on the affected device.

Recommendations: For NETGEAR D6100 versions prior to V1.0.0.55, update to V1.0.0.55 or later. For NETGEAR D7800 versions prior to V1.0.1.24, update to V1.0.1.24 or later. For NETGEAR EX6150v2 versions prior to 1.0.0.48, update to 1.0.0.48 or later. For NETGEAR R6100 versions prior to 1.0.1.14, update to 1.0.1.14 or later. For NETGEAR R7500 versions prior to 1.0.0.110, update to 1.0.0.110 or later. For NETGEAR R7500v2 versions prior to V1.0.3.16, update to V1.0.3.16 or later. For NETGEAR R7800 versions prior to V1.0.2.36, update to V1.0.2.36 or later. For NETGEAR WNDR4300v1 versions prior to 1.0.2.90, update to 1.0.2.90 or later. For NETGEAR WNDR4300v2 versions prior to 1.0.0.48, update to 1.0.0.48 or later. For NETGEAR WNDR4500v3 versions prior to 1.0.0.48, update to 1.0.0.48 or later. For NETGEAR WNR2000v5 versions prior to 1.0.0.48, update to 1.0.0.48 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-18773

Affected Products

D6100

D7800

Ex6150V2

R6100

R7500

R7500V2

R7800

Wndr4300V1

Wndr4300V2

Wndr4500V3

Wnr2000V5

References · 5

• https://kb.netgear.com/000049556/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18773 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18773 · Vendor Advisory
• https://t.me/cvenotify/3011 · Telegram Post
• https://t.me/cibsecurity/11523 · Telegram Post