PT-2020-8405 · NetGear · Netgear M4300-24X+9

Published 2020-04-28 · Updated 2020-05-06 · CVE-2017-18858

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NETGEAR M4200-10MG-POE+ versions 12.0.2.11 and earlier NETGEAR M4300-28G versions 12.0.2.11 and earlier NETGEAR M4300-52G versions 12.0.2.11 and earlier NETGEAR M4300-28G-POE+ versions 12.0.2.11 and earlier NETGEAR M4300-52G-POE+ versions 12.0.2.11 and earlier NETGEAR M4300-8X8F versions 12.0.2.11 and earlier NETGEAR M4300-12X12F versions 12.0.2.11 and earlier NETGEAR M4300-24X24F versions 12.0.2.11 and earlier NETGEAR M4300-24X versions 12.0.2.11 and earlier NETGEAR M4300-48X versions 12.0.2.11 and earlier

Description: The issue affects certain NETGEAR devices, allowing for command execution.

Recommendations: For NETGEAR M4200-10MG-POE+ version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-28G version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-52G version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-28G-POE+ version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-52G-POE+ version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-8X8F version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-12X12F version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-24X24F version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-24X version 12.0.2.11 and earlier, update to a version later than 12.0.2.11. For NETGEAR M4300-48X version 12.0.2.11 and earlier, update to a version later than 12.0.2.11.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-18858

Affected Products

Netgear M4200-10Mg-Poe+

Netgear M4300-12X12F

Netgear M4300-24X

Netgear M4300-24X24F

Netgear M4300-28G

Netgear M4300-28G-Poe+

Netgear M4300-48X

Netgear M4300-52G

Netgear M4300-52G-Poe+

Netgear M4300-8X8F

References · 3

• https://kb.netgear.com/000038655/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-M4200-and-M4300-PSV-2017-1971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18858 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18858 · Vendor Advisory