PT-2020-8345 · NetGear · Netgear R7800+5

Published 2020-04-21 · Updated 2020-04-23 · CVE-2017-18796

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: NETGEAR R6400 versions prior to 1.0.1.24 NETGEAR R6700 versions prior to 1.0.1.26 NETGEAR R6900 versions prior to 1.0.1.28 NETGEAR R7000 versions prior to 1.0.9.10 NETGEAR R7000P versions prior to 1.0.1.16 NETGEAR R6900P versions prior to 1.0.1.16 NETGEAR R7800 versions prior to 1.0.2.36

Description: Certain NETGEAR devices are affected by command injection.

Recommendations: For R6400, update to version 1.0.1.24 or later. For R6700, update to version 1.0.1.26 or later. For R6900, update to version 1.0.1.28 or later. For R7000, update to version 1.0.9.10 or later. For R7000P, update to version 1.0.1.16 or later. For R6900P, update to version 1.0.1.16 or later. For R7800, update to version 1.0.2.36 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-18796

Affected Products

Netgear R6400

Netgear R6700

Netgear R6900P

Netgear R7000

Netgear R7000P

Netgear R7800

References · 5

• https://osv.dev/vulnerability/CVE-2017-18796 · Vendor Advisory
• https://kb.netgear.com/000049366/Security-Advisory-for-Command-Injection-Vulnerability-on-Some-Routers-PSV-2016-0106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18796 · Security Note
• https://t.me/cvenotify/2988 · Telegram Post
• https://t.me/cibsecurity/11482 · Telegram Post