PT-2020-8396 · NetGear · R6700+16

Martin Rakhmanov · Published 2020-04-20 · Updated 2020-04-22 · CVE-2017-18849

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: D6220 versions prior to 1.0.0.26 D6400 versions prior to 1.0.0.60 D8500 versions prior to 1.0.3.29 R6250 versions prior to 1.0.4.12 R6400 versions prior to 1.01.24 R6400v2 versions prior to 1.0.2.30 R6700 versions prior to 1.0.1.22 R6900 versions prior to 1.0.1.22 R6900P versions prior to 1.0.0.56 R7000 versions prior to 1.0.9.4 R7000P versions prior to 1.0.0.56 R7100LG versions prior to 1.0.0.32 R7300DST versions prior to 1.0.0.54 R7900 versions prior to 1.0.1.18 R8000 versions prior to 1.0.3.44 R8300 versions prior to 1.0.2.100 1.0.82 R8500 versions prior to 1.0.2.100 1.0.82

Description: Certain NETGEAR devices are affected by command injection.

Recommendations: For D6220 version prior to 1.0.0.26, update to version 1.0.0.26 or later. For D6400 version prior to 1.0.0.60, update to version 1.0.0.60 or later. For D8500 version prior to 1.0.3.29, update to version 1.0.3.29 or later. For R6250 version prior to 1.0.4.12, update to version 1.0.4.12 or later. For R6400 version prior to 1.01.24, update to version 1.01.24 or later. For R6400v2 version prior to 1.0.2.30, update to version 1.0.2.30 or later. For R6700 version prior to 1.0.1.22, update to version 1.0.1.22 or later. For R6900 version prior to 1.0.1.22, update to version 1.0.1.22 or later. For R6900P version prior to 1.0.0.56, update to version 1.0.0.56 or later. For R7000 version prior to 1.0.9.4, update to version 1.0.9.4 or later. For R7000P version prior to 1.0.0.56, update to version 1.0.0.56 or later. For R7100LG version prior to 1.0.0.32, update to version 1.0.0.32 or later. For R7300DST version prior to 1.0.0.54, update to version 1.0.0.54 or later. For R7900 version prior to 1.0.1.18, update to version 1.0.1.18 or later. For R8000 version prior to 1.0.3.44, update to version 1.0.3.44 or later. For R8300 version prior to 1.0.2.100 1.0.82, update to version 1.0.2.100 1.0.82 or later. For R8500 version prior to 1.0.2.100 1.0.82, update to version 1.0.2.100 1.0.82 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-18849

Affected Products

D6220

D6400

D8500

R6250

R6400

R6400V2

R6700

R6900

R6900P

R7000

R7000P

R7100Lg

R7300Dst

R7900

R8000

R8300

R8500

References · 4

• https://osv.dev/vulnerability/CVE-2017-18849 · Vendor Advisory
• https://kb.netgear.com/000048999/Security-Advisory-for-Command-Injection-on-Some-Routers-and-Modem-Routers-PSV-2017-1209 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18849 · Security Note
• https://t.me/cibsecurity/11406 · Telegram Post