Vulnerability CVE-2017-6366

Vulnerability Name:

CVE-2017-6366 (CCN-122633)

Assigned:

2017-02-28

Published:

2017-02-28

Updated:

2017-03-29

Summary:

Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi.
Note: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.

CVSS v3 Severity:

8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:U/RC:R)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-352

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2017-6366

Source: XF
Type: UNKNOWN
netgear-cve20176366-csrf(122633)

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [02-28-2017]

Source: EXPLOIT-DB
Type: Third Party Advisory, VDB Entry
41472

Source: CCN
Type: Netgear Web site
NETGEAR DGN2200

Vulnerable Configuration:

Configuration 1:

cpe:/o:netgear:dgn2200_firmware:*:*:*:*:*:*:*:* (Version <= 10.0.0.50)

AND

cpe:/h:netgear:dgn2200v1:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:dgn2200v2:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:dgn2200v3:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:dgn2200v4:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK