PT-2020-8767 · NetGear · Netgear Wc7600V1+3

Chen Ruiqi · Published 2020-04-22 · Updated 2020-04-24 · CVE-2018-21123

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR WC7500 versions prior to 6.5.3.9 NETGEAR WC7520 versions prior to 6.5.3.9 NETGEAR WC7600v1 versions prior to 6.5.3.9 NETGEAR WC7600v2 versions prior to 6.5.3.9

Description The issue allows command injection by an unauthenticated attacker.

Recommendations For NETGEAR WC7500 versions prior to 6.5.3.9, update to version 6.5.3.9 or later. For NETGEAR WC7520 versions prior to 6.5.3.9, update to version 6.5.3.9 or later. For NETGEAR WC7600v1 versions prior to 6.5.3.9, update to version 6.5.3.9 or later. For NETGEAR WC7600v2 versions prior to 6.5.3.9, update to version 6.5.3.9 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2018-21123

Affected Products

Netgear Wc7500

Netgear Wc7520

Netgear Wc7600V1

Netgear Wc7600V2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-21123 · Security Note
• https://kb.netgear.com/000060235/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Wireless-Controllers-PSV-2018-0230 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-21123 · Vendor Advisory
• https://t.me/cvenotify/3043 · Telegram Post