ID

VAR-202004-1343


CVE

CVE-2017-18779


TITLE

plural NETGEAR Classic buffer overflow vulnerability in device

Trust: 0.8

sources: JVNDB: JVNDB-2017-014918

DESCRIPTION

Certain NETGEAR devices are affected by a buffer overflow. This affects D6200 before 1.1.00.24, D7000 before 1.0.1.52, JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.12, JWNR2010v5 before 1.1.0.44, PR2000 before 1.0.0.20, R6020 before 1.0.0.26, R6050 before 1.0.1.12, R6080 before 1.0.0.26, R6120 before 1.0.0.36, R6220 before 1.1.0.60, R6700v2 before 1.2.0.12, R6800 before 1.2.0.12, R6900v2 before 1.2.0.12, WNDR3700v5 before 1.1.0.50, WNR1000v4 before 1.1.0.44, WNR2020 before 1.1.0.44, and WNR2050 before 1.1.0.44. plural NETGEAR A classic buffer overflow vulnerability exists on the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR D6200, etc. are all products of NETGEAR. NETGEAR D6200 is a wireless modem. NETGEAR WNR2020 is a wireless router. NETGEAR R6220 is a wireless router. The vulnerability stems from the fact that the network system or product performs an operation on the memory, and the data boundary is not correctly verified, resulting in an incorrect read and write operation to other associated memory locations. The attacker The vulnerability can be exploited to cause buffer overflow or heap overflow

Trust: 2.16

sources: NVD: CVE-2017-18779 // JVNDB: JVNDB-2017-014918 // CNVD: CNVD-2020-31325

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-31325

AFFECTED PRODUCTS

vendor:netgearmodel:d6200scope:ltversion:1.1.00.24

Trust: 1.6

vendor:netgearmodel:r6120scope:ltversion:1.0.0.36

Trust: 1.6

vendor:netgearmodel:r6020scope:ltversion:1.0.0.26

Trust: 1.6

vendor:netgearmodel:r6080scope:ltversion:1.0.0.26

Trust: 1.6

vendor:netgearmodel:r6220scope:ltversion:1.1.0.60

Trust: 1.6

vendor:netgearmodel:jr6150scope:ltversion:1.0.1.12

Trust: 1.6

vendor:netgearmodel:pr2000scope:ltversion:1.0.0.20

Trust: 1.6

vendor:netgearmodel:r6050scope:ltversion:1.0.1.12

Trust: 1.6

vendor:netgearmodel:wnr2020scope:ltversion:1.1.0.44

Trust: 1.6

vendor:netgearmodel:wnr2050scope:ltversion:1.1.0.44

Trust: 1.6

vendor:netgearmodel:d7000scope:ltversion:1.0.1.52

Trust: 1.6

vendor:netgearmodel:r6800scope:ltversion:1.2.0.12

Trust: 1.6

vendor:netgearmodel:wndr3700scope:ltversion:1.1.0.50

Trust: 1.0

vendor:netgearmodel:jwnr2010scope:ltversion:1.1.0.44

Trust: 1.0

vendor:netgearmodel:wnr1000scope:ltversion:1.1.0.44

Trust: 1.0

vendor:netgearmodel:jnr1010scope:ltversion:1.1.0.44

Trust: 1.0

vendor:netgearmodel:r6700scope:ltversion:1.2.0.12

Trust: 1.0

vendor:netgearmodel:r6900scope:ltversion:1.2.0.12

Trust: 1.0

vendor:netgearmodel:d6200scope:eqversion:1.1.00.24

Trust: 0.8

vendor:netgearmodel:d7000scope:eqversion:1.0.1.52

Trust: 0.8

vendor:netgearmodel:jnr1010scope:eqversion:1.1.0.44

Trust: 0.8

vendor:netgearmodel:jr6150scope:eqversion:1.0.1.12

Trust: 0.8

vendor:netgearmodel:jwnr2010scope:eqversion:1.1.0.44

Trust: 0.8

vendor:netgearmodel:pr2000scope:eqversion:1.0.0.20

Trust: 0.8

vendor:netgearmodel:r6020scope:eqversion:1.0.0.26

Trust: 0.8

vendor:netgearmodel:r6050scope:eqversion:1.0.1.12

Trust: 0.8

vendor:netgearmodel:r6080scope:eqversion:1.0.0.26

Trust: 0.8

vendor:netgearmodel:r6120scope:eqversion:1.0.0.36

Trust: 0.8

vendor:netgearmodel:jnr1010v2scope:ltversion:1.1.0.44

Trust: 0.6

vendor:netgearmodel:jwnr2010v5scope:ltversion:1.1.0.44

Trust: 0.6

vendor:netgearmodel:wnr1000v4scope:ltversion:1.1.0.44

Trust: 0.6

vendor:netgearmodel:r6900v2scope:ltversion:1.2.0.12

Trust: 0.6

vendor:netgearmodel:r6700v2scope:ltversion:1.2.0.12

Trust: 0.6

vendor:netgearmodel:wndr3700v5scope:ltversion:1.1.0.50

Trust: 0.6

sources: CNVD: CNVD-2020-31325 // JVNDB: JVNDB-2017-014918 // NVD: CVE-2017-18779

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-18779
value: HIGH

Trust: 1.0

cve@mitre.org: CVE-2017-18779
value: HIGH

Trust: 1.0

NVD: JVNDB-2017-014918
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-31325
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202004-1883
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2017-18779
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2017-014918
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-31325
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2017-18779
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2017-18779
baseSeverity: HIGH
baseScore: 8.4
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.5
impactScore: 5.9
version: 3.0

Trust: 1.0

NVD: JVNDB-2017-014918
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-31325 // JVNDB: JVNDB-2017-014918 // CNNVD: CNNVD-202004-1883 // NVD: CVE-2017-18779 // NVD: CVE-2017-18779

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.8

sources: JVNDB: JVNDB-2017-014918 // NVD: CVE-2017-18779

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202004-1883

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202004-1883

CONFIGURATIONS

[
  {
    "CVE_data_version": "4.0",
    "nodes": [
      {
        "operator": "OR",
        "cpe_match": [
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:d6200_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:d7000_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:jnr1010_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:jr6150_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:jwnr2010_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:pr2000_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:r6020_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:r6050_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:r6080_firmware"
          },
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:netgear:r6120_firmware"
          }
        ]
      }
    ]
  }
]

sources: JVNDB: JVNDB-2017-014918

PATCH

title:Security Advisory for Buffer Overflow on Some Routers, PSV-2017-2956url:https://kb.netgear.com/000049541/Security-Advisory-for-Buffer-Overflow-on-Some-Routers-PSV-2017-2956

Trust: 0.8

title:Patch for Multiple NETGEAR product buffer overflow vulnerabilities (CNVD-2020-31325)url:https://www.cnvd.org.cn/patchInfo/show/220035

Trust: 0.6

title:Multiple NETGEAR Product Buffer Error Vulnerability Fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=116659

Trust: 0.6

sources: CNVD: CNVD-2020-31325 // JVNDB: JVNDB-2017-014918 // CNNVD: CNNVD-202004-1883

EXTERNAL IDS

db:NVDid:CVE-2017-18779

Trust: 3.0

db:JVNDBid:JVNDB-2017-014918

Trust: 0.8

db:CNVDid:CNVD-2020-31325

Trust: 0.6

db:CNNVDid:CNNVD-202004-1883

Trust: 0.6

sources: CNVD: CNVD-2020-31325 // JVNDB: JVNDB-2017-014918 // CNNVD: CNNVD-202004-1883 // NVD: CVE-2017-18779

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2017-18779

Trust: 2.0

url:https://kb.netgear.com/000049541/security-advisory-for-buffer-overflow-on-some-routers-psv-2017-2956

Trust: 1.6

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18779

Trust: 0.8

sources: CNVD: CNVD-2020-31325 // JVNDB: JVNDB-2017-014918 // CNNVD: CNNVD-202004-1883 // NVD: CVE-2017-18779

SOURCES

db:CNVDid:CNVD-2020-31325
db:JVNDBid:JVNDB-2017-014918
db:CNNVDid:CNNVD-202004-1883
db:NVDid:CVE-2017-18779

LAST UPDATE DATE

2024-11-23T22:37:25.089000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2020-31325date:2020-06-03T00:00:00
db:JVNDBid:JVNDB-2017-014918date:2020-05-21T00:00:00
db:CNNVDid:CNNVD-202004-1883date:2020-04-26T00:00:00
db:NVDid:CVE-2017-18779date:2024-11-21T03:20:53.920

SOURCES RELEASE DATE

db:CNVDid:CNVD-2020-31325date:2020-06-03T00:00:00
db:JVNDBid:JVNDB-2017-014918date:2020-05-21T00:00:00
db:CNNVDid:CNNVD-202004-1883date:2020-04-22T00:00:00
db:NVDid:CVE-2017-18779date:2020-04-22T15:15:12.410