var-202004-1358
Vulnerability from variot
Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.4.8, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000P before 1.0.0.86, R6900P before 1.0.0.56, R7300 before 1.0.0.54, R8300 before 1.0.2.106, R8500 before 1.0.2.106, DGN2200v4 before 1.0.0.86, DGND2200Bv4 before 1.0.0.86, R6050 before 1.0.0.86, JR6150 before 1.0.1.10, R6220 before 1.1.0.50, and WNDR3700v5 before V1.1.0.48. plural NETGEAR A cross-site request forgery vulnerability exists in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR R6700, etc. are all wireless routers from NETGEAR. Attackers can use this vulnerability to read arbitrary files
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202004-1358", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "r6900", "scope": "lt", "trust": 1.6, "vendor": "netgear", "version": "1.0.1.22" }, { "model": "r7000p", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.0.86" }, { "model": "dgnd2200b", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.0.86" }, { "model": "r6700", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.1.22" }, { "model": "dgn2200", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.0.86" }, { "model": "jr6150", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.1.10" }, { "model": "r6050", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.0.86" }, { "model": "r8300", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.2.106" }, { "model": "r6400", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.2.32" }, { "model": "r8500", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.2.106" }, { "model": "r6220", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.1.0.50" }, { "model": "r7300", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.0.54" }, { "model": "wndr3700", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.1.0.48" }, { "model": "r6900p", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.0.56" }, { "model": "r6300", "scope": "lt", "trust": 1.0, "vendor": "netgear", "version": "1.0.4.8" }, { "model": "dgn2200", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.0.86" }, { "model": "r6300", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.4.8" }, { "model": "r6400", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.2.32" }, { "model": "r6700", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.1.22" }, { "model": "r6900", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.1.22" }, { "model": "r6900p", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.0.56" }, { "model": "r7000p", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.0.86" }, { "model": "r7300", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.0.54" }, { "model": "r8300", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.2.106" }, { "model": "r8500", "scope": "eq", "trust": 0.8, "vendor": "netgear", "version": "1.0.2.106" }, { "model": "r8500", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.2.94" }, { "model": "r7300dst", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.0.52" }, { "model": "ex3700", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.0.64" }, { "model": "ex3800", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.0.64" }, { "model": "ex6120", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.0.32" }, { "model": "ex6130", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.0.16" }, { "model": "r6300v2", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.4.12" }, { "model": "r6700", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.1.26" }, { "model": "r7000", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.9.6" }, { "model": "r7900", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.1.12" }, { "model": "r8000", "scope": "lt", "trust": 0.6, "vendor": "netgear", "version": "1.0.3.24" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2021-57165" }, { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "NVD", "id": "CVE-2017-18755" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:netgear:dgn2200_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r6300_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r6400_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r6700_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r6900_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r6900p_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r7000p_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r7300_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r8300_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:netgear:r8500_firmware", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-014922" } ] }, "cve": "CVE-2017-18755", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CVE-2017-18755", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 1.0, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 6.8, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "JVNDB-2017-014922", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CNVD-2021-57165", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "id": "CVE-2017-18755", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "cve@mitre.org", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "id": "CVE-2017-18755", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 8.8, "baseSeverity": "High", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "JVNDB-2017-014922", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Changed", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2017-18755", "trust": 1.0, "value": "HIGH" }, { "author": "cve@mitre.org", "id": "CVE-2017-18755", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "JVNDB-2017-014922", "trust": 0.8, "value": "High" }, { "author": "CNVD", "id": "CNVD-2021-57165", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-202004-1928", "trust": 0.6, "value": "HIGH" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2021-57165" }, { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "CNNVD", "id": "CNNVD-202004-1928" }, { "db": "NVD", "id": "CVE-2017-18755" }, { "db": "NVD", "id": "CVE-2017-18755" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.4.8, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000P before 1.0.0.86, R6900P before 1.0.0.56, R7300 before 1.0.0.54, R8300 before 1.0.2.106, R8500 before 1.0.2.106, DGN2200v4 before 1.0.0.86, DGND2200Bv4 before 1.0.0.86, R6050 before 1.0.0.86, JR6150 before 1.0.1.10, R6220 before 1.1.0.50, and WNDR3700v5 before V1.1.0.48. plural NETGEAR A cross-site request forgery vulnerability exists in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. NETGEAR R6700, etc. are all wireless routers from NETGEAR. Attackers can use this vulnerability to read arbitrary files", "sources": [ { "db": "NVD", "id": "CVE-2017-18755" }, { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "CNVD", "id": "CNVD-2021-57165" } ], "trust": 2.16 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2017-18755", "trust": 3.0 }, { "db": "JVNDB", "id": "JVNDB-2017-014922", "trust": 0.8 }, { "db": "CNVD", "id": "CNVD-2021-57165", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202004-1928", "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2021-57165" }, { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "CNNVD", "id": "CNNVD-202004-1928" }, { "db": "NVD", "id": "CVE-2017-18755" } ] }, "id": "VAR-202004-1358", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2021-57165" } ], "trust": 1.0257907004761906 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2021-57165" } ] }, "last_update_date": "2024-11-23T22:05:40.304000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Security Advisory for Cross Site Request Forgery on Routers and Modem Routers, PSV-2017-0333", "trust": 0.8, "url": "https://kb.netgear.com/000051493/Security-Advisory-for-Cross-Site-Request-Forgery-on-Routers-and-Modem-Routers-PSV-2017-0333" }, { "title": "Patch for Cross-site request forgery vulnerability in multiple NETGEAR products (CNVD-2021-57165)", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/282696" }, { "title": "Multiple NETGEAR Repair measures for product cross-site request forgery vulnerability", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=117254" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2021-57165" }, { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "CNNVD", "id": "CNNVD-202004-1928" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-352", "trust": 1.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "NVD", "id": "CVE-2017-18755" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.0, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-18755" }, { "trust": 1.6, "url": "https://kb.netgear.com/000051493/security-advisory-for-cross-site-request-forgery-on-routers-and-modem-routers-psv-2017-0333" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18755" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2021-57165" }, { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "CNNVD", "id": "CNNVD-202004-1928" }, { "db": "NVD", "id": "CVE-2017-18755" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2021-57165" }, { "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "db": "CNNVD", "id": "CNNVD-202004-1928" }, { "db": "NVD", "id": "CVE-2017-18755" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-07-28T00:00:00", "db": "CNVD", "id": "CNVD-2021-57165" }, { "date": "2020-05-21T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "date": "2020-04-22T00:00:00", "db": "CNNVD", "id": "CNNVD-202004-1928" }, { "date": "2020-04-22T17:15:11.777000", "db": "NVD", "id": "CVE-2017-18755" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2021-07-31T00:00:00", "db": "CNVD", "id": "CNVD-2021-57165" }, { "date": "2020-05-21T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-014922" }, { "date": "2020-04-26T00:00:00", "db": "CNNVD", "id": "CNNVD-202004-1928" }, { "date": "2024-11-21T03:20:50.513000", "db": "NVD", "id": "CVE-2017-18755" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202004-1928" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "plural NETGEAR Cross-site request forgery vulnerability in device", "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-014922" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "cross-site request forgery", "sources": [ { "db": "CNNVD", "id": "CNNVD-202004-1928" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.