PT-2023-26689 · NetGear · Netgear R6300V2+2

Published 2023-08-07 · Updated 2023-08-09 · CVE-2023-38925

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netgear DC112A version 1.0.0.64 Netgear EX6200 version 1.0.3.94 Netgear R6300v2 version 1.0.4.8

Description A buffer overflow issue was discovered via the http passwd parameter in password.cgi. This issue affects Netgear devices.

Recommendations For Netgear DC112A version 1.0.0.64, consider disabling access to the password.cgi until a patch is available. For Netgear EX6200 version 1.0.3.94, restrict the use of the http passwd parameter in the password.cgi to minimize the risk of exploitation. For Netgear R6300v2 version 1.0.4.8, avoid using the http passwd parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2023-38925

Affected Products

Netgear Dc112A

Netgear Ex6200

Netgear R6300V2

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-38925 · Security Note
• https://netgear.com/about/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38925 · Vendor Advisory
• https://github.com/FirmRec/IoT-Vulns/blob/main/netgear/http_passwd_smb_pass/README.md · Note
• https://t.me/cvenotify/55944 · Telegram Post