PT-2022-4911 · NetGear · Netgear N300 Wireless Router

Published 2022-01-08 · Updated 2022-09-24 · CVE-2022-37232

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netgear N300 wireless router wnr2000v4 version V1.0.0.70

Description The issue is related to a buffer overflow vulnerability caused by the strcpy() function in the uhttpd web server, which can lead to a stack overflow. This vulnerability can be exploited by a remote attacker to cause a denial of service. The vulnerability is associated with the processing of configuration files in the uhttpd web server.

Recommendations For Netgear N300 wireless router wnr2000v4 version V1.0.0.70, consider disabling the uhttpd web server or restricting access to it until a patch is available. As a temporary workaround, avoid using the strcpy() function in the uhttpd web server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-06079

CVE-2022-37232

Affected Products

Netgear N300 Wireless Router

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2022-37232 · Security Note
• https://netgear.com/about/security · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06079 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37232 · Vendor Advisory
• https://t.me/cibsecurity/50300 · Telegram Post
• ❌ https://github.com/Davidteeri/Bug-Report/blob/main/netgear-n300-0x429cbc.md · Note, Deleted
• https://t.me/cvenotify/36770 · Telegram Post
• https://t.me/cvenotify/36736 · Telegram Post
• https://netgear.com/support/download/?model=WNR2000v4 · Note
• https://vuldb.com/ru/?id.209352 · Note