Sign-up

ID

VAR-202004-0737


CVE

CVE-2019-20757


TITLE

NETGEAR R7800 On the device OS Command injection vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2019-015296

DESCRIPTION

NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user. NETGEAR R7800 On the device OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR R7800 is a wireless router of NETGEAR. The vulnerability stems from the fact that the network system or product did not properly filter the special elements in the process of constructing executable commands from external input data. Attackers can use this vulnerability to execute illegal commands

Trust: 2.16

sources: NVD: CVE-2019-20757 // JVNDB: JVNDB-2019-015296 // CNVD: CNVD-2020-23423

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-23423

AFFECTED PRODUCTS

vendor:netgearmodel:r7800scope:ltversion:1.0.2.62

Trust: 1.6

vendor:netgearmodel:r7800scope:eqversion:1.0.2.52

Trust: 0.8

sources: CNVD: CNVD-2020-23423 // JVNDB: JVNDB-2019-015296 // NVD: CVE-2019-20757

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-20757
value: MEDIUM

Trust: 1.0

cve@mitre.org: CVE-2019-20757
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2019-015296
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2020-23423
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202004-1368
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2019-20757
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2019-015296
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-23423
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-20757
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2019-20757
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.0

Trust: 1.0

NVD: JVNDB-2019-015296
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-23423 // JVNDB: JVNDB-2019-015296 // CNNVD: CNNVD-202004-1368 // NVD: CVE-2019-20757 // NVD: CVE-2019-20757

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:CWE-78

Trust: 0.8

sources: JVNDB: JVNDB-2019-015296 // NVD: CVE-2019-20757

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202004-1368

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202004-1368

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-015296

PATCH
title:Security Advisory for Post-Authentication Command Injection on R7800, PSV-2018-0358url:https://kb.netgear.com/000060642/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0358
Trust: 0.8
title:Patch for NETGEAR R7800 command injection vulnerability (CNVD-2020-23423)url:https://www.cnvd.org.cn/patchInfo/show/214451
Trust: 0.6
title:NETGEAR R7800 Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=116597
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-23423 // 
            
            
            
            JVNDB: JVNDB-2019-015296 // 
            
            
            
            CNNVD: CNNVD-202004-1368

EXTERNAL IDS
db:NVDid:CVE-2019-20757
Trust: 3.0
db:JVNDBid:JVNDB-2019-015296
Trust: 0.8
db:CNVDid:CNVD-2020-23423
Trust: 0.6
db:CNNVDid:CNNVD-202004-1368
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-23423 // 
            
            
            
            JVNDB: JVNDB-2019-015296 // 
            
            
            
            CNNVD: CNNVD-202004-1368 // 
            
            
            
            NVD: CVE-2019-20757

REFERENCES
url:https://kb.netgear.com/000060642/security-advisory-for-post-authentication-command-injection-on-r7800-psv-2018-0358
Trust: 2.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-20757
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-20757
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2020-23423 // 
            
            
            
            JVNDB: JVNDB-2019-015296 // 
            
            
            
            CNNVD: CNNVD-202004-1368 // 
            
            
            
            NVD: CVE-2019-20757

SOURCES
db:CNVDid:CNVD-2020-23423
db:JVNDBid:JVNDB-2019-015296
db:CNNVDid:CNNVD-202004-1368
db:NVDid:CVE-2019-20757

LAST UPDATE DATE
2024-11-23T22:51:27.290000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-23423date:2020-04-18T00:00:00
db:JVNDBid:JVNDB-2019-015296date:2020-05-11T00:00:00
db:CNNVDid:CNNVD-202004-1368date:2020-04-26T00:00:00
db:NVDid:CVE-2019-20757date:2024-11-21T04:39:17.127

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-23423date:2020-04-17T00:00:00
db:JVNDBid:JVNDB-2019-015296date:2020-05-11T00:00:00
db:CNNVDid:CNNVD-202004-1368date:2020-04-16T00:00:00
db:NVDid:CVE-2019-20757date:2020-04-16T22:15:13.040