PT-2020-8330 · NetGear · Jnr1010V2+17

Published 2020-04-22 · Updated 2020-04-24 · CVE-2017-18781

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: D6200 versions prior to 1.1.00.24 D7000 versions prior to 1.0.1.52 JNR1010v2 versions prior to 1.1.0.44 JWNR2010v5 versions prior to 1.1.0.44 JR6150 versions prior to 1.0.1.12 PR2000 versions prior to 1.0.0.20 R6020 versions prior to 1.0.0.26 R6050 versions prior to 1.0.1.12 R6080 versions prior to 1.0.0.26 R6120 versions prior to 1.0.0.36 R6220 versions prior to 1.1.0.60 R6700v2 versions prior to 1.2.0.12 R6800 versions prior to 1.2.0.12 R6900v2 versions prior to 1.2.0.12 WNDR3700v5 versions prior to 1.1.0.50 WNR1000v4 versions prior to 1.1.0.44 WNR2020 versions prior to 1.1.0.44 WNR2050 versions prior to 1.1.0.44

Description: Certain NETGEAR devices are affected by a CSRF issue.

Recommendations: As a temporary workaround, consider implementing CSRF protection measures until a patch is available for each of the affected devices. For D6200, update to version 1.1.00.24 or later. For D7000, update to version 1.0.1.52 or later. For JNR1010v2, update to version 1.1.0.44 or later. For JWNR2010v5, update to version 1.1.0.44 or later. For JR6150, update to version 1.0.1.12 or later. For PR2000, update to version 1.0.0.20 or later. For R6020, update to version 1.0.0.26 or later. For R6050, update to version 1.0.1.12 or later. For R6080, update to version 1.0.0.26 or later. For R6120, update to version 1.0.0.36 or later. For R6220, update to version 1.1.0.60 or later. For R6700v2, update to version 1.2.0.12 or later. For R6800, update to version 1.2.0.12 or later. For R6900v2, update to version 1.2.0.12 or later. For WNDR3700v5, update to version 1.1.0.50 or later. For WNR1000v4, update to version 1.1.0.44 or later. For WNR2020, update to version 1.1.0.44 or later. For WNR2050, update to version 1.1.0.44 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-18781

Affected Products

D6200

D7000

Jnr1010V2

Jr6150

Jwnr2010V5

Pr2000

R6020

R6050

R6080

R6120

R6220

R6700V2

R6800

R6900V2

Wndr3700V5

Wnr1000V4

Wnr2020

Wnr2050

References · 5

• https://osv.dev/vulnerability/CVE-2017-18781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18781 · Security Note
• https://kb.netgear.com/000049538/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2017-2954 · Vendor Advisory
• https://t.me/cvenotify/3018 · Telegram Post
• https://t.me/cibsecurity/11516 · Telegram Post