PT-2020-8519 · NetGear · Netgear Wc7600V1+4

Alexander Oleinik + 5 · Published 2020-04-01 · Updated 2020-08-24 · CVE-2018-11106

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: NETGEAR WC7500 versions prior to 6.5.3.5 NETGEAR WC7520 versions prior to 2.5.0.46 NETGEAR WC7600v1 versions prior to 6.5.3.5 NETGEAR WC7600v2 versions prior to 6.5.3.5 NETGEAR WC9500 versions prior to 6.5.3.5

Description: The issue is a pre-authentication command injection in the request handler.php file. This allows for potential exploitation without the need for authentication. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations: For NETGEAR WC7500, update to firmware version 6.5.3.5 or later. For NETGEAR WC7520, update to firmware version 2.5.0.46 or later. For NETGEAR WC7600v1, update to firmware version 6.5.3.5 or later. For NETGEAR WC7600v2, update to firmware version 6.5.3.5 or later. For NETGEAR WC9500, update to firmware version 6.5.3.5 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2018-11106

Affected Products

Netgear Wc7500

Netgear Wc7520

Netgear Wc7600V1

Netgear Wc7600V2

Netgear Wc9500

References · 4

• https://osv.dev/vulnerability/CVE-2018-11106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11106 · Security Note
• https://kb.netgear.com/000058243/Security-Advisory-for-Pre-Authentication-Command-Injection-in-request-handler-php-on-Some-Wireless-Controllers-PSV-2018-0051 · Note
• https://t.me/cibsecurity/10912 · Telegram Post