PT-2020-8384 · NetGear · Netgear M4300-24X+9

Published 2020-04-20 · Updated 2020-04-23 · CVE-2017-18837

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NETGEAR M4300-28G versions prior to 12.0.2.15 NETGEAR M4300-52G versions prior to 12.0.2.15 NETGEAR M4300-28G-POE+ versions prior to 12.0.2.15 NETGEAR M4300-52G-POE+ versions prior to 12.0.2.15 NETGEAR M4300-8X8F versions prior to 12.0.2.15 NETGEAR M4300-12X12F versions prior to 12.0.2.15 NETGEAR M4300-24X24F versions prior to 12.0.2.15 NETGEAR M4300-24X versions prior to 12.0.2.15 NETGEAR M4300-48X versions prior to 12.0.2.15 NETGEAR M4200 versions prior to 12.0.2.15

Description: The issue is related to vertical privilege escalation, affecting certain NETGEAR devices.

Recommendations: For NETGEAR M4300-28G versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-52G versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-28G-POE+ versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-52G-POE+ versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-8X8F versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-12X12F versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-24X24F versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-24X versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4300-48X versions prior to 12.0.2.15, update to version 12.0.2.15 or later. For NETGEAR M4200 versions prior to 12.0.2.15, update to version 12.0.2.15 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2017-18837

Affected Products

Netgear M4200

Netgear M4300-12X12F

Netgear M4300-24X

Netgear M4300-24X24F

Netgear M4300-28G

Netgear M4300-28G-Poe+

Netgear M4300-48X

Netgear M4300-52G

Netgear M4300-52G-Poe+

Netgear M4300-8X8F

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-18837 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18837 · Vendor Advisory
• https://kb.netgear.com/000049025/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Fully-Managed-Switches-PSV-2017-1973 · Vendor Advisory
• https://t.me/cvenotify/2940 · Telegram Post
• https://t.me/cibsecurity/11421 · Telegram Post