Details of VAR-202004-1357

ID

VAR-202004-1357

CVE

CVE-2017-18754

TITLE

plural NETGEAR Injection vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2017-014921

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WNDR3700v4 before 1.0.2.88, WNDR4300v1 before 1.0.2.90, and WNR2000v5 before 1.0.0.58. NETGEAR WNDR3700 , WNDR4300 , WNR2000 A device contains an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR WNDR3700, etc. are all wireless routers from NETGEAR. There are injection vulnerabilities in NETGEAR WNDR3700v4 versions before 1.0.2.88, WNDR4300v1 versions before 1.0.2.90, and WNR2000v5 versions before 1.0.0.58. The vulnerability stems from the fact that the network system or product lacks the correct verification of the user input data during the operation process of the user inputting the construction command, data structure or record, and the special elements are not filtered or correctly filtered, resulting in the analysis or analysis of the system or product. The explanation is wrong. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2017-18754 // JVNDB: JVNDB-2017-014921 // CNVD: CNVD-2021-52949

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-52949

AFFECTED PRODUCTS

vendor:	netgear	model:	wndr3700	scope:	lt	version:	1.0.2.88	Trust: 1.0
vendor:	netgear	model:	wndr4300	scope:	lt	version:	1.0.2.90	Trust: 1.0
vendor:	netgear	model:	wnr2000	scope:	lt	version:	1.0.0.58	Trust: 1.0
vendor:	netgear	model:	wndr3700	scope:	eq	version:	1.0.2.88	Trust: 0.8
vendor:	netgear	model:	wndr4300	scope:	eq	version:	1.0.2.90	Trust: 0.8
vendor:	netgear	model:	wnr2000	scope:	eq	version:	1.0.0.58	Trust: 0.8
vendor:	netgear	model:	wnr2000v5	scope:	lt	version:	1.0.0.58	Trust: 0.6
vendor:	netgear	model:	wndr3700v4	scope:	lt	version:	1.0.2.88	Trust: 0.6
vendor:	netgear	model:	wndr4300v1	scope:	lt	version:	1.0.2.90	Trust: 0.6

sources: CNVD: CNVD-2021-52949 // JVNDB: JVNDB-2017-014921 // NVD: CVE-2017-18754

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-18754
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2017-18754
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2017-014921
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2021-52949
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202004-1929
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2017-18754
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2017-014921
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2021-52949
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2017-18754
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2017-18754
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.0
Trust: 1.0
NVD:	JVNDB-2017-014921
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-52949 // JVNDB: JVNDB-2017-014921 // CNNVD: CNNVD-202004-1929 // NVD: CVE-2017-18754 // NVD: CVE-2017-18754

PROBLEMTYPE DATA

problemtype:

CWE-74

Trust: 1.8

sources: JVNDB: JVNDB-2017-014921 // NVD: CVE-2017-18754

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202004-1929

TYPE

injection

Trust: 0.6

sources: CNNVD: CNNVD-202004-1929

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014921

PATCH

title:	Security Advisory for Post-Authentication Command Injection on Routers, PSV-2017-0329	url:	https://kb.netgear.com/000051494/Security-Advisory-for-Post-Authentication-Command-Injection-on-Routers-PSV-2017-0329	Trust: 0.8
title:	Patch for NETGEAR WNDR3700, WNDR4300 and WNR2000 injection vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/280041	Trust: 0.6
title:	NETGEAR WNDR3700 , WNDR4300 and WNR2000 Repair measures for injecting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=117255	Trust: 0.6

sources: CNVD: CNVD-2021-52949 // JVNDB: JVNDB-2017-014921 // CNNVD: CNNVD-202004-1929

EXTERNAL IDS

db:	NVD	id:	CVE-2017-18754	Trust: 3.0
db:	JVNDB	id:	JVNDB-2017-014921	Trust: 0.8
db:	CNVD	id:	CNVD-2021-52949	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-1929	Trust: 0.6

sources: CNVD: CNVD-2021-52949 // JVNDB: JVNDB-2017-014921 // CNNVD: CNNVD-202004-1929 // NVD: CVE-2017-18754

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2017-18754	Trust: 2.0
url:	https://kb.netgear.com/000051494/security-advisory-for-post-authentication-command-injection-on-routers-psv-2017-0329	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18754	Trust: 0.8

sources: CNVD: CNVD-2021-52949 // JVNDB: JVNDB-2017-014921 // CNNVD: CNNVD-202004-1929 // NVD: CVE-2017-18754

SOURCES

db:	CNVD	id:	CNVD-2021-52949
db:	JVNDB	id:	JVNDB-2017-014921
db:	CNNVD	id:	CNNVD-202004-1929
db:	NVD	id:	CVE-2017-18754

LAST UPDATE DATE

2024-11-23T22:55:10.536000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-52949	date:	2021-07-21T00:00:00
db:	JVNDB	id:	JVNDB-2017-014921	date:	2020-05-21T00:00:00
db:	CNNVD	id:	CNNVD-202004-1929	date:	2020-04-26T00:00:00
db:	NVD	id:	CVE-2017-18754	date:	2024-11-21T03:20:50.367

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-52949	date:	2020-07-21T00:00:00
db:	JVNDB	id:	JVNDB-2017-014921	date:	2020-05-21T00:00:00
db:	CNNVD	id:	CNNVD-202004-1929	date:	2020-04-22T00:00:00
db:	NVD	id:	CVE-2017-18754	date:	2020-04-22T17:15:11.667