Details of VAR-201907-0797

ID

VAR-201907-0797

CVE

CVE-2019-14363

TITLE

NETGEAR WNDR3400v3 Router buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-007246

DESCRIPTION

A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.18_1.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet. NETGEAR WNDR3400v3 The router contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NETGEARWNDR3400v3 is a wireless router from NETGEAR. The vulnerability stems from a network system or product that does not properly validate data boundaries when performing operations on memory, causing erroneous read and write operations to be performed on other associated memory locations. An attacker could exploit the vulnerability to cause a buffer overflow or heap overflow

Trust: 2.25

sources: NVD: CVE-2019-14363 // JVNDB: JVNDB-2019-007246 // CNVD: CNVD-2019-24852 // VULMON: CVE-2019-14363

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-24852

AFFECTED PRODUCTS

vendor:	netgear	model:	wndr3400v3	scope:	gte	version:	1.0.1.18	Trust: 1.0
vendor:	netgear	model:	wndr3400v3	scope:	lte	version:	1.0.1.24	Trust: 1.0
vendor:	net gear	model:	wndr3400v3	scope:	eq	version:	1.0.1.18_1.0.63	Trust: 0.8
vendor:	netgear	model:	wndr3400v3 1.0.1.18 1.0.63	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2019-24852 // JVNDB: JVNDB-2019-007246 // NVD: CVE-2019-14363

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-14363
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-14363
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2019-24852
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201907-1430
value:	HIGH
Trust: 0.6
VULMON:	CVE-2019-14363
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2019-14363
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2019-24852
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-14363
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2019-24852 // VULMON: CVE-2019-14363 // JVNDB: JVNDB-2019-007246 // CNNVD: CNNVD-201907-1430 // NVD: CVE-2019-14363

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	CWE-119	Trust: 0.8

sources: JVNDB: JVNDB-2019-007246 // NVD: CVE-2019-14363

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-1430

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201907-1430

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-007246

PATCH

title:

WNDR3400v3

url:

https://www.netgear.com/support/product/WNDR3400v3.aspx

Trust: 0.8

sources: JVNDB: JVNDB-2019-007246

EXTERNAL IDS

db:	NVD	id:	CVE-2019-14363	Trust: 3.1
db:	JVNDB	id:	JVNDB-2019-007246	Trust: 0.8
db:	CNVD	id:	CNVD-2019-24852	Trust: 0.6
db:	CNNVD	id:	CNNVD-201907-1430	Trust: 0.6
db:	VULMON	id:	CVE-2019-14363	Trust: 0.1

sources: CNVD: CNVD-2019-24852 // VULMON: CVE-2019-14363 // JVNDB: JVNDB-2019-007246 // CNNVD: CNNVD-201907-1430 // NVD: CVE-2019-14363

REFERENCES

url:	https://github.com/reevesrs24/cve/blob/master/netgear_wndr2400v3/upnp_stack_overflow/upnp_stack_overflow.md	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-14363	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-14363	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/787.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2019-24852 // VULMON: CVE-2019-14363 // JVNDB: JVNDB-2019-007246 // CNNVD: CNNVD-201907-1430 // NVD: CVE-2019-14363

SOURCES

db:	CNVD	id:	CNVD-2019-24852
db:	VULMON	id:	CVE-2019-14363
db:	JVNDB	id:	JVNDB-2019-007246
db:	CNNVD	id:	CNNVD-201907-1430
db:	NVD	id:	CVE-2019-14363

LAST UPDATE DATE

2024-11-23T22:11:57.315000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-24852	date:	2019-07-30T00:00:00
db:	VULMON	id:	CVE-2019-14363	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-007246	date:	2019-08-06T00:00:00
db:	CNNVD	id:	CNNVD-201907-1430	date:	2020-09-02T00:00:00
db:	NVD	id:	CVE-2019-14363	date:	2024-11-21T04:26:35.747

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2019-24852	date:	2019-07-30T00:00:00
db:	VULMON	id:	CVE-2019-14363	date:	2019-07-28T00:00:00
db:	JVNDB	id:	JVNDB-2019-007246	date:	2019-08-06T00:00:00
db:	CNNVD	id:	CNNVD-201907-1430	date:	2019-07-28T00:00:00
db:	NVD	id:	CVE-2019-14363	date:	2019-07-28T18:15:11.107