PT-2020-8340 · NetGear · Netgear R6220+11

Joel St. John · Published 2020-04-21 · Updated 2020-05-04 · CVE-2017-18791

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NETGEAR R6050/JR6150 versions prior to 1.0.1.7 NETGEAR PR2000 versions prior to 1.0.0.17 NETGEAR R6220 versions prior to 1.1.0.50 NETGEAR WNDR3700v5 versions prior to 1.1.0.48 NETGEAR JNR1010v2 versions prior to 1.1.0.40 NETGEAR JWNR2010v5 versions prior to 1.1.0.40 NETGEAR WNR1000v4 versions prior to 1.1.0.40 NETGEAR WNR2020 versions prior to 1.1.0.40 NETGEAR WNR2050 versions prior to 1.1.0.40 NETGEAR WNR614 versions prior to 1.1.0.40 NETGEAR WNR618 versions prior to 1.1.0.40 NETGEAR D7000 versions prior to 1.0.1.50

Description: Certain NETGEAR devices are affected by a CSRF issue.

Recommendations: For NETGEAR R6050/JR6150 versions prior to 1.0.1.7, update to version 1.0.1.7 or later. For NETGEAR PR2000 versions prior to 1.0.0.17, update to version 1.0.0.17 or later. For NETGEAR R6220 versions prior to 1.1.0.50, update to version 1.1.0.50 or later. For NETGEAR WNDR3700v5 versions prior to 1.1.0.48, update to version 1.1.0.48 or later. For NETGEAR JNR1010v2 versions prior to 1.1.0.40, update to version 1.1.0.40 or later. For NETGEAR JWNR2010v5 versions prior to 1.1.0.40, update to version 1.1.0.40 or later. For NETGEAR WNR1000v4 versions prior to 1.1.0.40, update to version 1.1.0.40 or later. For NETGEAR WNR2020 versions prior to 1.1.0.40, update to version 1.1.0.40 or later. For NETGEAR WNR2050 versions prior to 1.1.0.40, update to version 1.1.0.40 or later. For NETGEAR WNR614 versions prior to 1.1.0.40, update to version 1.1.0.40 or later. For NETGEAR WNR618 versions prior to 1.1.0.40, update to version 1.1.0.40 or later. For NETGEAR D7000 versions prior to 1.0.1.50, update to version 1.0.1.50 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-18791

Affected Products

Netgear R7000

Netgear Jnr1010V2

Netgear Jwnr2010V5

Netgear Pr2000

Netgear R6050/Jr6150

Netgear R6220

Netgear Wndr3700V5

Netgear Wnr1000V4

Netgear Wnr2020

Netgear Wnr2050

Netgear Wnr614

Netgear Wnr618

References · 5

• https://kb.netgear.com/000049371/Security-Advisory-for-Cross-Site-Request-Forgery-Vulnerability-on-D7000-and-Some-Routers-PSV-2017-0386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18791 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18791 · Vendor Advisory
• https://t.me/cibsecurity/11487 · Telegram Post
• https://t.me/cvenotify/2983 · Telegram Post