PT-2020-8814 · NetGear · Netgear R7800+4

Mongo · Published 2020-04-27 · Updated 2020-05-01 · CVE-2018-21170

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR EX2700 versions prior to 1.0.1.28 NETGEAR R7800 versions prior to 1.0.2.40 NETGEAR WN2000RPTv3 versions prior to 1.0.1.20 NETGEAR WN3000RPv3 versions prior to 1.0.2.50 NETGEAR WN3100RPv2 versions prior to 1.0.0.56

Description The issue is a stack-based buffer overflow that can be exploited by an unauthenticated attacker.

Recommendations For NETGEAR EX2700 version prior to 1.0.1.28, update to version 1.0.1.28 or later. For NETGEAR R7800 version prior to 1.0.2.40, update to version 1.0.2.40 or later. For NETGEAR WN2000RPTv3 version prior to 1.0.1.20, update to version 1.0.1.20 or later. For NETGEAR WN3000RPv3 version prior to 1.0.2.50, update to version 1.0.2.50 or later. For NETGEAR WN3100RPv2 version prior to 1.0.0.56, update to version 1.0.0.56 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-21170

Affected Products

Netgear Ex2700

Netgear R7800

Netgear Wn2000Rptv3

Netgear Wn3000Rpv3

Netgear Wn3100Rpv2

References · 4

• https://osv.dev/vulnerability/CVE-2018-21170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-21170 · Security Note
• https://kb.netgear.com/000055188/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Extenders-PSV-2017-2638 · Vendor Advisory
• https://t.me/cvenotify/3274 · Telegram Post