Details of VAR-202004-1363

ID

VAR-202004-1363

CVE

CVE-2017-18761

TITLE

NETGEAR R8000 Out-of-bounds write vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2017-014902

DESCRIPTION

NETGEAR R8000 devices before 1.0.4.2 are affected by a stack-based buffer overflow by an authenticated user. NETGEAR R8000 The device is vulnerable to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR R8000 is a wireless router from NETGEAR. The vulnerability stems from the fact that when the network system or product performs operations on the memory, the data boundary is not correctly verified, resulting in incorrect read and write operations to other associated memory locations. Attackers can use this vulnerability to cause buffer overflow or heap overflow

Trust: 2.16

sources: NVD: CVE-2017-18761 // JVNDB: JVNDB-2017-014902 // CNVD: CNVD-2021-59158

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-59158

AFFECTED PRODUCTS

vendor:	netgear	model:	r8000	scope:	lt	version:	1.0.4.2	Trust: 1.6
vendor:	netgear	model:	r8000	scope:	eq	version:	1.0.4.2	Trust: 0.8

sources: CNVD: CNVD-2021-59158 // JVNDB: JVNDB-2017-014902 // NVD: CVE-2017-18761

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-18761
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2017-18761
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2017-014902
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2021-59158
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202004-1908
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2017-18761
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2017-014902
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2021-59158
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2017-18761
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2017-18761
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.0
Trust: 1.0
NVD:	JVNDB-2017-014902
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-59158 // JVNDB: JVNDB-2017-014902 // CNNVD: CNNVD-202004-1908 // NVD: CVE-2017-18761 // NVD: CVE-2017-18761

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.8

sources: JVNDB: JVNDB-2017-014902 // NVD: CVE-2017-18761

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202004-1908

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202004-1908

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014902

PATCH

title:	Security Advisory for Post-Authentication Stack Overflow on R8000, PSV-2017-2229	url:	https://kb.netgear.com/000051484/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R8000-PSV-2017-2229	Trust: 0.8
title:	Patch for NETGEAR R8000 buffer overflow vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/284331	Trust: 0.6
title:	NETGEAR R8000 Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=117244	Trust: 0.6

sources: CNVD: CNVD-2021-59158 // JVNDB: JVNDB-2017-014902 // CNNVD: CNNVD-202004-1908

EXTERNAL IDS

db:	NVD	id:	CVE-2017-18761	Trust: 3.0
db:	JVNDB	id:	JVNDB-2017-014902	Trust: 0.8
db:	CNVD	id:	CNVD-2021-59158	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-1908	Trust: 0.6

sources: CNVD: CNVD-2021-59158 // JVNDB: JVNDB-2017-014902 // CNNVD: CNNVD-202004-1908 // NVD: CVE-2017-18761

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2017-18761	Trust: 2.0
url:	https://kb.netgear.com/000051484/security-advisory-for-post-authentication-stack-overflow-on-r8000-psv-2017-2229	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18761	Trust: 0.8

sources: CNVD: CNVD-2021-59158 // JVNDB: JVNDB-2017-014902 // CNNVD: CNNVD-202004-1908 // NVD: CVE-2017-18761

SOURCES

db:	CNVD	id:	CNVD-2021-59158
db:	JVNDB	id:	JVNDB-2017-014902
db:	CNNVD	id:	CNNVD-202004-1908
db:	NVD	id:	CVE-2017-18761

LAST UPDATE DATE

2024-11-23T23:11:27.078000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-59158	date:	2021-08-08T00:00:00
db:	JVNDB	id:	JVNDB-2017-014902	date:	2020-05-21T00:00:00
db:	CNNVD	id:	CNNVD-202004-1908	date:	2020-04-26T00:00:00
db:	NVD	id:	CVE-2017-18761	date:	2024-11-21T03:20:51.293

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-59158	date:	2021-08-08T00:00:00
db:	JVNDB	id:	JVNDB-2017-014902	date:	2020-05-21T00:00:00
db:	CNNVD	id:	CNNVD-202004-1908	date:	2020-04-22T00:00:00
db:	NVD	id:	CVE-2017-18761	date:	2020-04-22T16:15:11.310