PT-2020-8792 · NetGear · R7500+12

Aircut · Published 2020-04-21 · Updated 2020-04-24 · CVE-2018-21148

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N

Name of the Vulnerable Software and Affected Versions D7800 versions prior to 1.0.1.34 DM200 versions prior to 1.0.0.50 R6100 versions prior to 1.0.1.22 R7500 versions prior to 1.0.0.122 R7500v2 versions prior to 1.0.3.26 R7800 versions prior to 1.0.2.42 R8900 version 1.0.3.10 R9000 version 1.0.3.10 WNDR3700v4 versions prior to 1.0.2.96 WNDR4300 versions prior to 1.0.2.98 WNDR4300v2 versions prior to 1.0.0.54 WNDR4500v3 versions prior to 1.0.0.54 WNR2000v5 versions prior to 1.0.0.64

Description Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.

Recommendations Update D7800 to version 1.0.1.34 or later Update DM200 to version 1.0.0.50 or later Update R6100 to version 1.0.1.22 or later Update R7500 to version 1.0.0.122 or later Update R7500v2 to version 1.0.3.26 or later Update R7800 to version 1.0.2.42 or later Update R8900 to a version later than 1.0.3.10 Update R9000 to a version later than 1.0.3.10 Update WNDR3700v4 to version 1.0.2.96 or later Update WNDR4300 to version 1.0.2.98 or later Update WNDR4300v2 to version 1.0.0.54 or later Update WNDR4500v3 to version 1.0.0.54 or later Update WNR2000v5 to version 1.0.0.64 or later

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-21148

Affected Products

D7800

Dm200

R6100

R7500

R7500V2

R7800

R8900

R9000

Wndr3700V4

Wndr4300

Wndr4300V2

Wndr4500V3

Wnr2000V5

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-21148 · Security Note
• https://kb.netgear.com/000059485/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Gateways-and-Routers-PSV-2017-3157 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-21148 · Vendor Advisory
• https://t.me/cvenotify/3005 · Telegram Post