PT-2020-8351 · NetGear · Netgear R7800+4

Published 2020-04-21 · Updated 2020-04-23 · CVE-2017-18802

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NETGEAR R6100 versions prior to 1.0.1.14 NETGEAR R7500 versions prior to 1.0.0.110 NETGEAR R7500v2 versions prior to 1.0.3.16 NETGEAR R7800 versions prior to 1.0.2.32 NETGEAR EX6200v2 versions prior to 1.0.1.50 NETGEAR D7800 versions prior to 1.0.1.22

Description: The issue is related to command injection, affecting certain NETGEAR devices.

Recommendations: For R6100 version prior to 1.0.1.14, update to version 1.0.1.14 or later. For R7500 version prior to 1.0.0.110, update to version 1.0.0.110 or later. For R7500v2 version prior to 1.0.3.16, update to version 1.0.3.16 or later. For R7800 version prior to 1.0.2.32, update to version 1.0.2.32 or later. For EX6200v2 version prior to 1.0.1.50, update to version 1.0.1.50 or later. For D7800 version prior to 1.0.1.22, update to version 1.0.1.22 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-18802

Affected Products

Netgear R7800

Netgear Ex6200V2

Netgear R6100

Netgear R7500

Netgear R7500V2

References · 5

• https://osv.dev/vulnerability/CVE-2017-18802 · Vendor Advisory
• https://kb.netgear.com/000049354/Security-Advisory-for-Command-Injection-Vulnerability-on-D7000-EX6200v2-and-Some-Routers-PSV-2017-2181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18802 · Security Note
• https://t.me/cibsecurity/11474 · Telegram Post
• https://t.me/cvenotify/2977 · Telegram Post