Details of VAR-202005-0731

ID

VAR-202005-0731

CVE

CVE-2017-18865

TITLE

NETGEAR R8300 and R8500 Out-of-bounds write vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2017-014980

DESCRIPTION

Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8300 before 1.0.2.104 and R8500 before 1.0.2.104. NETGEAR R8300 and R8500 The device is vulnerable to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR R8500 and NETGEAR R8300 are both a wireless router of NETGEAR. The vulnerability stems from the fact that when the network system or product performs operations on the memory, the data boundary is not correctly verified, resulting in incorrect read and write operations to other associated memory locations. Attackers can use this vulnerability to cause buffer overflow or heap overflow. This affects R8300 prior to 1.0.2.104 and R8500 prior to 1.0.2.104

Trust: 2.25

sources: NVD: CVE-2017-18865 // JVNDB: JVNDB-2017-014980 // CNVD: CNVD-2021-46350 // VULMON: CVE-2017-18865

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-46350

AFFECTED PRODUCTS

vendor:	netgear	model:	r8300	scope:	lt	version:	1.0.2.104	Trust: 1.6
vendor:	netgear	model:	r8500	scope:	lt	version:	1.0.2.104	Trust: 1.6
vendor:	netgear	model:	r8300	scope:	eq	version:	1.0.2.104	Trust: 0.8
vendor:	netgear	model:	r8500	scope:	eq	version:	1.0.2.104	Trust: 0.8

sources: CNVD: CNVD-2021-46350 // JVNDB: JVNDB-2017-014980 // NVD: CVE-2017-18865

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-18865
value:	MEDIUM
Trust: 1.0
cve@mitre.org:	CVE-2017-18865
value:	MEDIUM
Trust: 1.0
NVD:	JVNDB-2017-014980
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2021-46350
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202005-113
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2017-18865
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-18865
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2017-014980
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2021-46350
severity:	MEDIUM
baseScore:	5.2
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2017-18865
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2017-18865
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.0
Trust: 1.0
NVD:	JVNDB-2017-014980
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-46350 // VULMON: CVE-2017-18865 // JVNDB: JVNDB-2017-014980 // CNNVD: CNNVD-202005-113 // NVD: CVE-2017-18865 // NVD: CVE-2017-18865

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.8

sources: JVNDB: JVNDB-2017-014980 // NVD: CVE-2017-18865

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202005-113

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202005-113

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-014980

PATCH

title:	Security Advisory for Post-Authentication Stack Overflow on R8300 and R8500, PSV-2017-2228	url:	https://kb.netgear.com/000051485/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R8300-and-R8500-PSV-2017-2228	Trust: 0.8
title:	Patch for NETGEAR R8500 and R8300 buffer overflow vulnerability (CNVD-2021-46350)	url:	https://www.cnvd.org.cn/patchInfo/show/275806	Trust: 0.6
title:	NETGEAR R8500 and R8300 Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=117670	Trust: 0.6

sources: CNVD: CNVD-2021-46350 // JVNDB: JVNDB-2017-014980 // CNNVD: CNNVD-202005-113

EXTERNAL IDS

db:	NVD	id:	CVE-2017-18865	Trust: 3.1
db:	JVNDB	id:	JVNDB-2017-014980	Trust: 0.8
db:	CNVD	id:	CNVD-2021-46350	Trust: 0.6
db:	CNNVD	id:	CNNVD-202005-113	Trust: 0.6
db:	VULMON	id:	CVE-2017-18865	Trust: 0.1

sources: CNVD: CNVD-2021-46350 // VULMON: CVE-2017-18865 // JVNDB: JVNDB-2017-014980 // CNNVD: CNNVD-202005-113 // NVD: CVE-2017-18865

REFERENCES

url:	https://nvd.nist.gov/vuln/detail/cve-2017-18865	Trust: 2.0
url:	https://kb.netgear.com/000051485/security-advisory-for-post-authentication-stack-overflow-on-r8300-and-r8500-psv-2017-2228	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18865	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/787.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2021-46350 // VULMON: CVE-2017-18865 // JVNDB: JVNDB-2017-014980 // CNNVD: CNNVD-202005-113 // NVD: CVE-2017-18865

SOURCES

db:	CNVD	id:	CNVD-2021-46350
db:	VULMON	id:	CVE-2017-18865
db:	JVNDB	id:	JVNDB-2017-014980
db:	CNNVD	id:	CNNVD-202005-113
db:	NVD	id:	CVE-2017-18865

LAST UPDATE DATE

2024-11-23T23:01:22.800000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-46350	date:	2021-07-01T00:00:00
db:	VULMON	id:	CVE-2017-18865	date:	2020-05-06T00:00:00
db:	JVNDB	id:	JVNDB-2017-014980	date:	2020-05-28T00:00:00
db:	CNNVD	id:	CNNVD-202005-113	date:	2020-05-07T00:00:00
db:	NVD	id:	CVE-2017-18865	date:	2024-11-21T03:21:07.697

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-46350	date:	2021-06-27T00:00:00
db:	VULMON	id:	CVE-2017-18865	date:	2020-05-05T00:00:00
db:	JVNDB	id:	JVNDB-2017-014980	date:	2020-05-28T00:00:00
db:	CNNVD	id:	CNNVD-202005-113	date:	2020-05-05T00:00:00
db:	NVD	id:	CVE-2017-18865	date:	2020-05-05T14:15:12.250