PT-2020-8778 · NetGear · Ex3700+30

Aircut · Published 2020-04-23 · Updated 2020-05-04 · CVE-2018-21134

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR R6700 versions 1.0.0 through 1.0.1.47 NETGEAR R7900 versions 1.0.0 through 1.0.2.15 NETGEAR R6900 versions 1.0.0 through 1.0.1.47 NETGEAR R7000P versions 1.0.0 through 1.3.1.43 NETGEAR R6900P versions 1.0.0 through 1.3.1.43 NETGEAR R6250 versions 1.0.0 through 1.0.4.29 NETGEAR R6300v2 versions 1.0.0 through 1.0.4.31 NETGEAR R6400 versions 1.0.0 through 1.0.1.43 NETGEAR R6400v2 versions 1.0.0 through 1.0.2.59 NETGEAR R7000 versions 1.0.0 through 1.0.9.33 NETGEAR R7100LG versions 1.0.0 through 1.0.0.47 NETGEAR R7300 versions 1.0.0 through 1.0.0.67 NETGEAR R8000 versions 1.0.0 through 1.0.4.17 NETGEAR R8000P versions 1.0.0 through 1.4.1.23 NETGEAR R7900P versions 1.0.0 through 1.4.1.23 NETGEAR R8500 versions 1.0.0 through 1.0.2.121 NETGEAR R8300 versions 1.0.0 through 1.0.2.121 NETGEAR WN2500RPv2 versions 1.0.0 through 1.0.1.53 NETGEAR EX3700 versions 1.0.0 through 1.0.0.71 NETGEAR EX3800 versions 1.0.0 through 1.0.0.71 NETGEAR EX6000 versions 1.0.0 through 1.0.0.31 NETGEAR EX6100 versions 1.0.0 through 1.0.2.23 NETGEAR EX6120 versions 1.0.0 through 1.0.0.41 NETGEAR EX6130 versions 1.0.0 through 1.0.0.23 NETGEAR EX6150v1 versions 1.0.0 through 1.0.0.41 NETGEAR EX6200 versions 1.0.0 through 1.0.3.87 NETGEAR EX7000 versions 1.0.0 through 1.0.0.65 NETGEAR D7000v2 versions 1.0.0 through 1.0.0.50 NETGEAR D6220 versions 1.0.0 through 1.0.0.45 NETGEAR D6400 versions 1.0.0 through 1.0.0.81 NETGEAR D8500 versions 1.0.0 through 1.0.3.41

Description The issue is a stack-based buffer overflow that can be exploited by an unauthenticated attacker.

Recommendations For NETGEAR R6700 versions 1.0.0 through 1.0.1.47, update to version 1.0.1.48 or later. For NETGEAR R7900 versions 1.0.0 through 1.0.2.15, update to version 1.0.2.16 or later. For NETGEAR R6900 versions 1.0.0 through 1.0.1.47, update to version 1.0.1.48 or later. For NETGEAR R7000P versions 1.0.0 through 1.3.1.43, update to version 1.3.1.44 or later. For NETGEAR R6900P versions 1.0.0 through 1.3.1.43, update to version 1.3.1.44 or later. For NETGEAR R6250 versions 1.0.0 through 1.0.4.29, update to version 1.0.4.30 or later. For NETGEAR R6300v2 versions 1.0.0 through 1.0.4.31, update to version 1.0.4.32 or later. For NETGEAR R6400 versions 1.0.0 through 1.0.1.43, update to version 1.0.1.44 or later. For NETGEAR R6400v2 versions 1.0.0 through 1.0.2.59, update to version 1.0.2.60 or later. For NETGEAR R7000 versions 1.0.0 through 1.0.9.33, update to version 1.0.9.34 or later. For NETGEAR R7100LG versions 1.0.0 through 1.0.0.47, update to version 1.0.0.48 or later. For NETGEAR R7300 versions 1.0.0 through 1.0.0.67, update to version 1.0.0.68 or later. For NETGEAR R8000 versions 1.0.0 through 1.0.4.17, update to version 1.0.4.18 or later. For NETGEAR R8000P versions 1.0.0 through 1.4.1.23, update to version 1.4.1.24 or later. For NETGEAR R7900P versions 1.0.0 through 1.4.1.23, update to version 1.4.1.24 or later. For NETGEAR R8500 versions 1.0.0 through 1.0.2.121, update to version 1.0.2.122 or later. For NETGEAR R8300 versions 1.0.0 through 1.0.2.121, update to version 1.0.2.122 or later. For NETGEAR WN2500RPv2 versions 1.0.0 through 1.0.1.53, update to version 1.0.1.54 or later. For NETGEAR EX3700 versions 1.0.0 through 1.0.0.71, update to version 1.0.0.72 or later. For NETGEAR EX3800 versions 1.0.0 through 1.0.0.71, update to version 1.0.0.72 or later. For NETGEAR EX6000 versions 1.0.0 through 1.0.0.31, update to version 1.0.0.32 or later. For NETGEAR EX6100 versions 1.0.0 through 1.0.2.23, update to version 1.0.2.24 or later. For NETGEAR EX6120 versions 1.0.0 through 1.0.0.41, update to version 1.0.0.42 or later. For NETGEAR EX6130 versions 1.0.0 through 1.0.0.23, update to version 1.0.0.24 or later. For NETGEAR EX6150v1 versions 1.0.0 through 1.0.0.41, update to version 1.0.0.42 or later. For NETGEAR EX6200 versions 1.0.0 through 1.0.3.87, update to version 1.0.3.88 or later. For NETGEAR EX7000 versions 1.0.0 through 1.0.0.65, update to version 1.0.0.66 or later. For NETGEAR D7000v2 versions 1.0.0 through 1.0.0.50, update to version 1.0.0.51 or later. For NETGEAR D6220 versions 1.0.0 through 1.0.0.45, update to version 1.0.0.46 or later. For NETGEAR D6400 versions 1.0.0 through 1.0.0.81, update to version 1.0.0.82 or later. For NETGEAR D8500 versions 1.0.0 through 1.0.3.41, update to version 1.0.3.42 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-21134

Affected Products

D6220

D6400

D7000V2

D8500

Ex3700

Ex3800

Ex6000

Ex6100

Ex6120

Ex6130

Ex6150V1

Ex6200

Ex7000

R6250

R6300V2

R6400

R6400V2

R6700

R6900

R6900P

R7000

R7000P

R7100Lg

R7300

R7900

R7900P

R8000

R8000P

R8300

R8500

Wn2500Rpv2

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-21134 · Security Note
• https://kb.netgear.com/000060226/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Wireless-Extenders-PSV-2017-2019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-21134 · Vendor Advisory
• https://t.me/cvenotify/3149 · Telegram Post