Vulnerability Name:

CVE-2017-18867 (CCN-181420)

Assigned:2017-10-27
Published:2017-10-27
Updated:2020-05-07
Summary:Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D6100 before 1.0.0.55, D7800 before V1.0.1.24, R7100LG before V1.0.0.32, WNDR4300v1 before 1.0.2.90, and WNDR4500v3 before 1.0.0.48.
CVSS v3 Severity:6.8 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
5.9 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-20
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2017-18867

Source: XF
Type: UNKNOWN
netgear-cve201718867-sec-bypass(181420)

Source: CCN
Type: NETGEAR Article ID: 000049554
Security Advisory for Security Misconfiguration on Some Routers and Gateways, PSV-2017-2198

Source: MISC
Type: Vendor Advisory
https://kb.netgear.com/000049554/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2017-2198

Vulnerable Configuration:Configuration 1:
  • cpe:/o:netgear:d6100_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.55)
  • AND
  • cpe:/h:netgear:d6100:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:netgear:d7800_firmware:*:*:*:*:*:*:*:* (Version < 1.0.1.24)
  • AND
  • cpe:/h:netgear:d7800:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:netgear:r7100lg_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.32)
  • AND
  • cpe:/h:netgear:r7100lg:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:netgear:wndr4300_firmware:*:*:*:*:*:*:*:* (Version < 1.0.2.90)
  • AND
  • cpe:/h:netgear:wndr4300:v1:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:netgear:wndr4500_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.48)
  • AND
  • cpe:/h:netgear:wndr4500:v3:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:netgear:d7800_firmware:1.0.1.23:*:*:*:*:*:*:*
  • OR cpe:/o:netgear:d6100_firmware:1.0.0.54:*:*:*:*:*:*:*
  • OR cpe:/o:netgear:r7100lg_firmware:1.0.0.31:*:*:*:*:*:*:*
  • OR cpe:/o:netgear:wndr4300v1_firmware:1.0.2.89:*:*:*:*:*:*:*
  • OR cpe:/o:netgear:wndr4500v3_firmware:1.0.0.47:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    netgear d6100 firmware *
    netgear d6100 -
    netgear d7800 firmware *
    netgear d7800 -
    netgear r7100lg firmware *
    netgear r7100lg -
    netgear wndr4300 firmware *
    netgear wndr4300 v1
    netgear wndr4500 firmware *
    netgear wndr4500 v3
    netgear d7800 firmware 1.0.1.23
    netgear d6100 firmware 1.0.0.54
    netgear r7100lg firmware 1.0.0.31
    netgear wndr4300v1 firmware 1.0.2.89
    netgear wndr4500v3 firmware 1.0.0.47