PT-2020-8346 · NetGear · Netgear R6400+3

Published 2020-04-21 · Updated 2020-04-27 · CVE-2017-18797

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NETGEAR R6400 versions prior to 1.0.1.24 NETGEAR R7900 versions prior to 1.0.1.18 NETGEAR R8000 versions prior to 1.0.3.54 NETGEAR R8500 versions prior to 1.0.2.100

Description: The issue allows an attacker to read arbitrary files on certain NETGEAR devices.

Recommendations: For NETGEAR R6400 version prior to 1.0.1.24, update to version 1.0.1.24 or later. For NETGEAR R7900 version prior to 1.0.1.18, update to version 1.0.1.18 or later. For NETGEAR R8000 version prior to 1.0.3.54, update to version 1.0.3.54 or later. For NETGEAR R8500 version prior to 1.0.2.100, update to version 1.0.2.100 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-18797

Affected Products

Netgear R6400

Netgear R7900

Netgear R8000

Netgear R8500

References · 5

• https://kb.netgear.com/000049365/Security-Advisory-for-Arbitrary-File-Read-Vulnerability-on-Some-Routers-PSV-2017-0318 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18797 · Security Note
• https://t.me/cvenotify/2989 · Telegram Post
• https://t.me/cibsecurity/11481 · Telegram Post