PT-2020-8382 · NetGear · Netgear M4300-24X+9

Published 2020-04-20 · Updated 2020-04-22 · CVE-2017-18835

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AC:L/AV:L/A:L/C:L/I:L/PR:N/S:C/UI:R

Name of the Vulnerable Software and Affected Versions: NETGEAR M4300-28G versions prior to 12.0.2.15 NETGEAR M4300-52G versions prior to 12.0.2.15 NETGEAR M4300-28G-POE+ versions prior to 12.0.2.15 NETGEAR M4300-52G-POE+ versions prior to 12.0.2.15 NETGEAR M4300-8X8F versions prior to 12.0.2.15 NETGEAR M4300-12X12F versions prior to 12.0.2.15 NETGEAR M4300-24X24F versions prior to 12.0.2.15 NETGEAR M4300-24X versions prior to 12.0.2.15 NETGEAR M4300-48X versions prior to 12.0.2.15 NETGEAR M4200 versions prior to 12.0.2.15

Description: The issue is related to reflected XSS, affecting certain NETGEAR devices.

Recommendations: For NETGEAR M4300-28G versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-52G versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-28G-POE+ versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-52G-POE+ versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-8X8F versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-12X12F versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-24X24F versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-24X versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-48X versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4200 versions prior to 12.0.2.15, update to version 12.0.2.15 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-18835

Affected Products

Netgear M4200

Netgear M4300-12X12F

Netgear M4300-24X

Netgear M4300-24X24F

Netgear M4300-28G

Netgear M4300-28G-Poe+

Netgear M4300-48X

Netgear M4300-52G

Netgear M4300-52G-Poe+

Netgear M4300-8X8F

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-18835 · Security Note
• https://kb.netgear.com/000049027/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Fully-Managed-Switches-PSV-2017-1957 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18835 · Vendor Advisory
• https://t.me/cibsecurity/11423 · Telegram Post
• https://t.me/cvenotify/2938 · Telegram Post