cnvd-2021-63379
Vulnerability from cnvd
Title
多款NETGEAR产品命令注入漏洞（CNVD-2021-63379）
Description
NETGEAR EX7000等都是美国网件（NETGEAR）公司的产品。NETGEAR EX7000是一款无线网络信号扩展器。NETGEAR DGN2200是一款无线路由器。NETGEAR R6400是一款无线路由器。 多款NETGEAR产品中存在命令注入漏洞。该漏洞源于外部输入数据构造可执行命令过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞执行非法命令。
Severity
中
Patch Name
多款NETGEAR产品命令注入漏洞（CNVD-2021-63379）的补丁
Patch Description
NETGEAR EX7000等都是美国网件（NETGEAR）公司的产品。NETGEAR EX7000是一款无线网络信号扩展器。NETGEAR DGN2200是一款无线路由器。NETGEAR R6400是一款无线路由器。 多款NETGEAR产品中存在命令注入漏洞。该漏洞源于外部输入数据构造可执行命令过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞执行非法命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://kb.netgear.com/000061195/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2228

Reference
https://nvd.nist.gov/vuln/detail/CVE-2019-20732
Impacted products
Name
['NETGEAR R6400v2 <1.0.2.44', 'NETGEAR R8500 <1.0.2.106', 'NETGEAR R8300 <1.0.2.106', 'NETGEAR EX3700 <1.0.0.70', 'NETGEAR EX3800 <1.0.0.70', 'NETGEAR EX6000 <1.0.0.30', 'NETGEAR EX6120 <1.0.0.40', 'NETGEAR EX6130 <1.0.0.22', 'NETGEAR EX6200 <1.0.3.88', 'NETGEAR EX7000 <1.0.0.66', 'NETGEAR R6700 <1.0.1.46', 'NETGEAR R6900 <1.0.1.46', 'NETGEAR R7900 <1.0.2.10', 'NETGEAR R8000P <1.3.0.10', 'NETGEAR R7900P <1.3.0.10', 'NETGEAR EX6150v1 <1.0.0.42', 'NETGEAR R8000 <1.0.4.12', 'NETGEAR WN2500RPv2 <1.0.1.54', 'NETGEAR R6400 <1.0.1.32', 'NETGEAR D6220 <1.0.0.40', 'NETGEAR D8500 <1.0.3.39', 'NETGEAR DGN2200v4 <1.0.0.102', 'NETGEAR EX6100 <1.0.2.22', 'NETGEAR R7300DST <1.0.0.62', 'NETGEAR WNDR3400v3 <1.0.1.18', 'NETGEAR WNR3500Lv2 <1.2.0.48', 'NETGEAR R7100LG <1.0.0.40', 'NETGEAR D7000v2 <1.0.0.74', 'NETGEAR R6250 <1.0.4.20', 'NETGEAR R7000 <1.0.9.26', 'NETGEAR R6900P <1.3.0.20', 'NETGEAR R7000P <1.3.0.20', 'NETGEAR DGND2200Bv4 <1.0.0.102', 'NETGEAR R6300v2 <1.0.4.24']
Show details on source website

To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-20732"
    }
  },
  "description": "NETGEAR EX7000\u7b49\u90fd\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08NETGEAR\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002NETGEAR EX7000\u662f\u4e00\u6b3e\u65e0\u7ebf\u7f51\u7edc\u4fe1\u53f7\u6269\u5c55\u5668\u3002NETGEAR DGN2200\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002NETGEAR R6400\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002\n\n\u591a\u6b3eNETGEAR\u4ea7\u54c1\u4e2d\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5916\u90e8\u8f93\u5165\u6570\u636e\u6784\u9020\u53ef\u6267\u884c\u547d\u4ee4\u8fc7\u7a0b\u4e2d\uff0c\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u6b63\u786e\u8fc7\u6ee4\u5176\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u975e\u6cd5\u547d\u4ee4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://kb.netgear.com/000061195/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2228",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-63379",
  "openTime": "2021-08-19",
  "patchDescription": "NETGEAR EX7000\u7b49\u90fd\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08NETGEAR\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002NETGEAR EX7000\u662f\u4e00\u6b3e\u65e0\u7ebf\u7f51\u7edc\u4fe1\u53f7\u6269\u5c55\u5668\u3002NETGEAR DGN2200\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002NETGEAR R6400\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002\r\n\r\n\u591a\u6b3eNETGEAR\u4ea7\u54c1\u4e2d\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5916\u90e8\u8f93\u5165\u6570\u636e\u6784\u9020\u53ef\u6267\u884c\u547d\u4ee4\u8fc7\u7a0b\u4e2d\uff0c\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u6b63\u786e\u8fc7\u6ee4\u5176\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u975e\u6cd5\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eNETGEAR\u4ea7\u54c1\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2021-63379\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NETGEAR R6400v2 \u003c1.0.2.44",
      "NETGEAR R8500 \u003c1.0.2.106",
      "NETGEAR R8300 \u003c1.0.2.106",
      "NETGEAR EX3700 \u003c1.0.0.70",
      "NETGEAR EX3800 \u003c1.0.0.70",
      "NETGEAR EX6000 \u003c1.0.0.30",
      "NETGEAR EX6120 \u003c1.0.0.40",
      "NETGEAR EX6130 \u003c1.0.0.22",
      "NETGEAR EX6200 \u003c1.0.3.88",
      "NETGEAR EX7000 \u003c1.0.0.66",
      "NETGEAR R6700 \u003c1.0.1.46",
      "NETGEAR R6900 \u003c1.0.1.46",
      "NETGEAR R7900 \u003c1.0.2.10",
      "NETGEAR R8000P \u003c1.3.0.10",
      "NETGEAR R7900P \u003c1.3.0.10",
      "NETGEAR EX6150v1 \u003c1.0.0.42",
      "NETGEAR R8000 \u003c1.0.4.12",
      "NETGEAR WN2500RPv2 \u003c1.0.1.54",
      "NETGEAR R6400 \u003c1.0.1.32",
      "NETGEAR D6220 \u003c1.0.0.40",
      "NETGEAR D8500 \u003c1.0.3.39",
      "NETGEAR DGN2200v4 \u003c1.0.0.102",
      "NETGEAR EX6100 \u003c1.0.2.22",
      "NETGEAR R7300DST \u003c1.0.0.62",
      "NETGEAR WNDR3400v3 \u003c1.0.1.18",
      "NETGEAR WNR3500Lv2 \u003c1.2.0.48",
      "NETGEAR R7100LG \u003c1.0.0.40",
      "NETGEAR D7000v2 \u003c1.0.0.74",
      "NETGEAR R6250 \u003c1.0.4.20",
      "NETGEAR R7000 \u003c1.0.9.26",
      "NETGEAR R6900P \u003c1.3.0.20",
      "NETGEAR R7000P \u003c1.3.0.20",
      "NETGEAR DGND2200Bv4 \u003c1.0.0.102",
      "NETGEAR R6300v2 \u003c1.0.4.24"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-20732",
  "serverity": "\u4e2d",
  "submitTime": "2020-04-17",
  "title": "\u591a\u6b3eNETGEAR\u4ea7\u54c1\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2021-63379\uff09"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.