PT-2020-8872 · NetGear · Netgear R7800+11

Nahamsec · Published 2020-04-24 · Updated 2020-04-28 · CVE-2018-21228

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR D7800 versions prior to 1.0.1.34 NETGEAR EX6100v2 versions prior to 1.0.1.50 NETGEAR EX6150v2 versions prior to 1.0.1.50 NETGEAR EX6200v2 versions prior to 1.0.1.44 NETGEAR EX6400 versions prior to 1.0.1.60 NETGEAR EX7300 versions prior to 1.0.1.60 NETGEAR R6100 versions prior to 1.0.1.16 NETGEAR R7500 versions prior to 1.0.0.110 NETGEAR R7800 versions prior to 1.0.2.32 NETGEAR R9000 versions prior to 1.0.2.30 NETGEAR WN3000RPv3 versions prior to 1.0.2.50 NETGEAR WNDR4300v2 versions prior to 1.0.0.50 NETGEAR WNDR4500v3 versions prior to 1.0.0.50

Description The issue allows command injection by an authenticated user.

Recommendations For NETGEAR D7800 version prior to 1.0.1.34, update to version 1.0.1.34 or later. For NETGEAR EX6100v2 version prior to 1.0.1.50, update to version 1.0.1.50 or later. For NETGEAR EX6150v2 version prior to 1.0.1.50, update to version 1.0.1.50 or later. For NETGEAR EX6200v2 version prior to 1.0.1.44, update to version 1.0.1.44 or later. For NETGEAR EX6400 version prior to 1.0.1.60, update to version 1.0.1.60 or later. For NETGEAR EX7300 version prior to 1.0.1.60, update to version 1.0.1.60 or later. For NETGEAR R6100 version prior to 1.0.1.16, update to version 1.0.1.16 or later. For NETGEAR R7500 version prior to 1.0.0.110, update to version 1.0.0.110 or later. For NETGEAR R7800 version prior to 1.0.2.32, update to version 1.0.2.32 or later. For NETGEAR R9000 version prior to 1.0.2.30, update to version 1.0.2.30 or later. For NETGEAR WN3000RPv3 version prior to 1.0.2.50, update to version 1.0.2.50 or later. For NETGEAR WNDR4300v2 version prior to 1.0.0.50, update to version 1.0.0.50 or later. For NETGEAR WNDR4500v3 version prior to 1.0.0.50, update to version 1.0.0.50 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2018-21228

Affected Products

Netgear R7800

Netgear Ex6100V2

Netgear Ex6150V2

Netgear Ex6200V2

Netgear Ex6400

Netgear Ex7300

Netgear R6100

Netgear R7500

Netgear R9000

Netgear Wn3000Rpv3

Netgear Wndr4300V2

Netgear Wndr4500V3

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-21228 · Security Note
• https://osv.dev/vulnerability/CVE-2018-21228 · Vendor Advisory
• https://kb.netgear.com/000055106/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0607 · Vendor Advisory