PT-2020-8757 · NetGear · R7500+11

Published 2020-04-22 · Updated 2020-04-24 · CVE-2018-21113

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions D6100 versions 1.0.0.0 through 1.0.0.57 D7800 versions 1.0.0.0 through 1.0.1.41 R6100 versions 1.0.0.0 through 1.0.1.27 R7500 versions 1.0.0.0 through 1.0.0.129 R7500v2 versions 1.0.0.0 through 1.0.3.35 R7800 versions 1.0.0.0 through 1.0.2.51 R8900 versions 1.0.0.0 through 1.0.4.11 R9000 versions 1.0.0.0 through 1.0.4.11 WNDR3700v4 versions 1.0.0.0 through 1.0.2.101 WNDR4300 versions 1.0.0.0 through 1.0.2.103 WNDR4300v2 versions 1.0.0.0 through 1.0.0.55 WNDR4500v3 versions 1.0.0.0 through 1.0.0.55

Description Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.

Recommendations For D6100 version 1.0.0.57 and earlier, update to version 1.0.0.58 or later. For D7800 version 1.0.1.41 and earlier, update to version 1.0.1.42 or later. For R6100 version 1.0.1.27 and earlier, update to version 1.0.1.28 or later. For R7500 version 1.0.0.129 and earlier, update to version 1.0.0.130 or later. For R7500v2 version 1.0.3.35 and earlier, update to version 1.0.3.36 or later. For R7800 version 1.0.2.51 and earlier, update to version 1.0.2.52 or later. For R8900 version 1.0.4.11 and earlier, update to version 1.0.4.12 or later. For R9000 version 1.0.4.11 and earlier, update to version 1.0.4.12 or later. For WNDR3700v4 version 1.0.2.101 and earlier, update to version 1.0.2.102 or later. For WNDR4300 version 1.0.2.103 and earlier, update to version 1.0.2.104 or later. For WNDR4300v2 version 1.0.0.55 and earlier, update to version 1.0.0.56 or later. For WNDR4500v3 version 1.0.0.55 and earlier, update to version 1.0.0.56 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2018-21113

Affected Products

D6100

D7800

R6100

R7500

R7500V2

R7800

R8900

R9000

Wndr3700V4

Wndr4300

Wndr4300V2

Wndr4500V3

References · 4

• https://osv.dev/vulnerability/CVE-2018-21113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-21113 · Security Note
• https://kb.netgear.com/000060438/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-Modem-Routers-PSV-2018-0033 · Vendor Advisory
• https://t.me/cvenotify/3027 · Telegram Post