PT-2020-8337 · NetGear · Netgear R7800+47

Robin Stenvi · Published 2020-04-22 · Updated 2020-05-04 · CVE-2017-18788

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: NETGEAR D3600 versions 1.0.0.0 through 1.0.0.66 NETGEAR D6000 versions 1.0.0.0 through 1.0.0.66 NETGEAR D6100 versions 1.0.0.0 through 1.0.0.55 NETGEAR D6200 versions 1.0.0.0 through 1.1.00.23 NETGEAR D6220 versions 1.0.0.0 through 1.0.0.31 NETGEAR D6400 versions 1.0.0.0 through 1.0.0.65 NETGEAR D7000 versions 1.0.0.0 through 1.0.1.51 NETGEAR D7000v2 versions 1.0.0.0 through 1.0.0.43 NETGEAR D7800 versions 1.0.0.0 through 1.0.1.29 NETGEAR D8500 versions 1.0.0.0 through 1.0.3.34 NETGEAR DGN2200v4 versions 1.0.0.0 through 1.0.0.95 NETGEAR DGN2200Bv4 versions 1.0.0.0 through 1.0.0.95 NETGEAR EX2700 versions 1.0.0.0 through 1.0.1.27 NETGEAR EX6150v2 versions 1.0.0.0 through 1.0.1.53 NETGEAR EX6100v2 versions 1.0.0.0 through 1.0.1.53 NETGEAR EX6200v2 versions 1.0.0.0 through 1.0.1.51 NETGEAR EX6400 versions 1.0.0.0 through 1.0.1.71 NETGEAR EX7300 versions 1.0.0.0 through 1.0.1.71 NETGEAR EX8000 versions 1.0.0.0 through 1.0.0.101 NETGEAR JNR1010v2 versions 1.0.0.0 through 1.1.0.43 NETGEAR JWNR2010v5 versions 1.0.0.0 through 1.1.0.43 NETGEAR PR2000 versions 1.0.0.0 through 1.0.0.19 NETGEAR R6100 versions 1.0.0.0 through 1.0.1.19 NETGEAR R6250 versions 1.0.0.0 through 1.0.4.15 NETGEAR R6300v2 versions 1.0.0.0 through 1.0.4.17 NETGEAR R6400 versions 1.0.0.0 through 1.0.1.31 NETGEAR R6400v2 versions 1.0.0.0 through 1.0.2.45 NETGEAR R6700 versions 1.0.0.0 through 1.0.1.35 NETGEAR R6900 versions 1.0.0.0 through 1.0.1.33 NETGEAR R7000 versions 1.0.0.0 through 1.0.9.17 NETGEAR R6900P versions 1.0.0.0 through 1.3.0.7 NETGEAR R7000P versions 1.0.0.0 through 1.3.0.7 NETGEAR R7100LG versions 1.0.0.0 through 1.0.0.33 NETGEAR R7300DST versions 1.0.0.0 through 1.0.0.57 NETGEAR R7500 versions 1.0.0.0 through 1.0.0.117 NETGEAR R7500v2 versions 1.0.0.0 through 1.0.3.23 NETGEAR R7800 versions 1.0.0.0 through 1.0.2.39 NETGEAR R7900 versions 1.0.0.0 through 1.0.2.3 NETGEAR R8000 versions 1.0.0.0 through 1.0.4.4 1.1.41 NETGEAR R7900P versions 1.0.0.0 through 1.1.5.13 NETGEAR R8000P versions 1.0.0.0 through 1.1.5.13 NETGEAR R8300 versions 1.0.0.0 through 1.0.2.109 NETGEAR R8500 versions 1.0.0.0 through 1.0.2.109 NETGEAR R9000 versions 1.0.0.0 through 1.0.2.51 NETGEAR WN2000RPTv3 versions 1.0.0.0 through 1.0.1.13 NETGEAR WN3000RPv3 versions 1.0.0.0 through 1.0.2.49 NETGEAR WN3100RPv2 versions 1.0.0.0 through 1.0.0.39 NETGEAR WNDR3400v3 versions 1.0.0.0 through 1.0.1.15 NETGEAR WNDR3700v4 versions 1.0.0.0 through 1.0.2.93 NETGEAR WNDR4300 versions 1.0.0.0 through 1.0.2.95 NETGEAR WNDR4300v2 versions 1.0.0.0 through 1.0.0.49 NETGEAR WNDR4500v3 versions 1.0.0.0 through 1.0.0.49 NETGEAR WNR1000v4 versions 1.0.0.0 through 1.1.0.43 NETGEAR WNR2000v5 versions 1.0.0.0 through 1.0.0.61 NETGEAR WNR2020 versions 1.0.0.0 through 1.1.0.43 NETGEAR WNR2050 versions 1.0.0.0 through 1.1.0.43 NETGEAR WNR3500Lv2 versions 1.0.0.0 through 1.2.0.45

Description: Certain NETGEAR devices are affected by command injection by an authenticated user.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-18788

Affected Products

Netgear D3600

Netgear D6000

Netgear R6100

Netgear D6200

Netgear R6220

Netgear R6400

Netgear R7000

Netgear D7000V2

Netgear R7800

Netgear R8500

Netgear Dgn2200V4

Netgear Ex2700

Netgear Ex6100V2

Netgear Ex6150V2

Netgear Ex6200V2

Netgear Ex6400

Netgear Ex7300

Netgear Ex8000

Netgear Jnr1010V2

Netgear Jwnr2010V5

Netgear Pr2000

Netgear R6250

Netgear R6300V2

Netgear R6400V2

Netgear R6700

Netgear R6900P

Netgear R7000P

Netgear R7100Lg

Netgear R7300Dst

Netgear R7500

Netgear R7500V2

Netgear R7900

Netgear R8000

Netgear R8300

Netgear R9000

Netgear Wn2000Rptv3

Netgear Wn3000Rpv3

Netgear Wn3100Rpv2

Netgear Wndr3400V3

Netgear Wndr3700V4

Netgear Wndr4300

Netgear Wndr4300V2

Netgear Wndr4500V3

Netgear Wnr1000V4

Netgear Wnr2000V5

Netgear Wnr2020

Netgear Wnr2050

Netgear Wnr3500Lv2

References · 4

• https://kb.netgear.com/000049527/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2947 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18788 · Security Note
• https://t.me/cibsecurity/11507 · Telegram Post