Vulnerability CVE-2020-35787 - CERT Civis.Net

Vulnerability Name:

CVE-2020-35787 (CCN-193603)

Assigned:

2020-12-16

Published:

2020-12-16

Updated:

2020-12-31

Summary:

Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6200 before 1.1.00.36, D7000 before 1.0.1.70, EX6200v2 before 1.0.1.78, EX7000 before 1.0.1.78, EX8000 before 1.0.1.186, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.42, R6050 before 1.0.1.18, R6080 before 1.0.0.42, R6120 before 1.0.0.46, R6220 before 1.1.0.80, R6260 before 1.1.0.64, R6300v2 before 1.0.4.34, R6700 before 1.0.2.6, R6700v2 before 1.2.0.36, R6800 before 1.2.0.36, R6900 before 1.0.2.4, R6900P before 1.3.1.64, R6900v2 before 1.2.0.36, R7000 before 1.0.9.42, R7000P before 1.3.1.64, R7800 before 1.0.2.60, R8900 before 1.0.4.12, R9000 before 1.0.4.12, and XR500 before 2.3.2.40.

CVSS v3 Severity:

8.0 High (CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.0 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

8.0 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.0 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Adjacent Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

5.2 Medium (CVSS v2 Vector: AV:A/AC:L/Au:S/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.7 High (CCN CVSS v2 Vector: AV:A/AC:L/Au:S/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Adjacent_Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2020-35787

Source: XF
Type: UNKNOWN
netgear-psv20180379-bo(193603)

Source: CCN
Type: NETGEAR Security Advisory: 000062710
Security Advisory for Post-Authentication Buffer Overflow on Some Routers and Range Extenders

Source: MISC
Type: Vendor Advisory
https://kb.netgear.com/000062710/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-and-Range-Extenders-PSV-2018-0379

Vulnerable Configuration:

Configuration 1:

cpe:/o:netgear:d3600_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.76)

AND

cpe:/h:netgear:d3600:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:netgear:d6000_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.76)

AND

cpe:/h:netgear:d6000:-:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:netgear:d6200_firmware:*:*:*:*:*:*:*:* (Version < 1.1.00.36)

AND

cpe:/h:netgear:d6200:-:*:*:*:*:*:*:*

Configuration 4:

cpe:/o:netgear:d7000_firmware:*:*:*:*:*:*:*:* (Version < 1.0.1.70)

AND

cpe:/h:netgear:d7000:-:*:*:*:*:*:*:*

Configuration 5:

cpe:/o:netgear:ex6200_firmware:*:*:*:*:*:*:*:* (Version < 1.0.1.78)

AND

cpe:/h:netgear:ex6200:v2:*:*:*:*:*:*:*

Configuration 6:

cpe:/o:netgear:ex7000_firmware:*:*:*:*:*:*:*:* (Version < 1.0.1.78)

AND

cpe:/h:netgear:ex7000:-:*:*:*:*:*:*:*

Configuration 7:

cpe:/o:netgear:ex8000_firmware:*:*:*:*:*:*:*:* (Version < 1.0.1.186)

AND

cpe:/h:netgear:ex8000:-:*:*:*:*:*:*:*

Configuration 8:

cpe:/o:netgear:jr6150_firmware:*:*:*:*:*:*:*:* (Version < 1.0.1.18)

AND

cpe:/h:netgear:jr6150:-:*:*:*:*:*:*:*

Configuration 9:

cpe:/o:netgear:pr2000_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.28)

AND

cpe:/h:netgear:pr2000:-:*:*:*:*:*:*:*

Configuration 10:

cpe:/o:netgear:r6020_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.42)

AND

cpe:/h:netgear:r6020:-:*:*:*:*:*:*:*

Configuration 11:

cpe:/o:netgear:r6050_firmware:*:*:*:*:*:*:*:* (Version < 1.0.1.18)

AND

cpe:/h:netgear:r6050:-:*:*:*:*:*:*:*

Configuration 12:

cpe:/o:netgear:r6080_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.42)

AND

cpe:/h:netgear:r6080:-:*:*:*:*:*:*:*

Configuration 13:

cpe:/o:netgear:r6120_firmware:*:*:*:*:*:*:*:* (Version < 1.0.0.46)

AND

cpe:/h:netgear:r6120:-:*:*:*:*:*:*:*

Configuration 14:

cpe:/o:netgear:r6220_firmware:*:*:*:*:*:*:*:* (Version < 1.1.0.80)

AND

cpe:/h:netgear:r6220:-:*:*:*:*:*:*:*

Configuration 15:

cpe:/o:netgear:r6260_firmware:*:*:*:*:*:*:*:* (Version < 1.1.0.64)

AND

cpe:/h:netgear:r6260:-:*:*:*:*:*:*:*

Configuration 16:

cpe:/o:netgear:r6300_firmware:*:*:*:*:*:*:*:* (Version < 1.0.4.34)

AND

cpe:/h:netgear:r6300:v2:*:*:*:*:*:*:*

Configuration 17:

cpe:/o:netgear:r6700_firmware:*:*:*:*:*:*:*:* (Version < 1.0.2.6)

AND

cpe:/h:netgear:r6700:-:*:*:*:*:*:*:*

Configuration 18:

cpe:/o:netgear:r6700_firmware:*:*:*:*:*:*:*:* (Version < 1.2.0.36)

AND

cpe:/h:netgear:r6700:v2:*:*:*:*:*:*:*

Configuration 19:

cpe:/o:netgear:r6800_firmware:*:*:*:*:*:*:*:* (Version < 1.2.0.36)

AND

cpe:/h:netgear:r6800:-:*:*:*:*:*:*:*

Configuration 20:

cpe:/o:netgear:r6900_firmware:*:*:*:*:*:*:*:* (Version < 1.0.2.4)

AND

cpe:/h:netgear:r6900:-:*:*:*:*:*:*:*

Configuration 21:

cpe:/o:netgear:r6900p_firmware:*:*:*:*:*:*:*:* (Version < 1.3.1.64)

AND

cpe:/h:netgear:r6900p:-:*:*:*:*:*:*:*

Configuration 22:

cpe:/o:netgear:r6900_firmware:*:*:*:*:*:*:*:* (Version < 1.2.0.36)

AND

cpe:/h:netgear:r6900:v2:*:*:*:*:*:*:*

Configuration 23:

cpe:/o:netgear:r7000_firmware:*:*:*:*:*:*:*:* (Version < 1.0.9.42)

AND

cpe:/h:netgear:r7000:-:*:*:*:*:*:*:*

Configuration 24:

cpe:/o:netgear:r7000p_firmware:*:*:*:*:*:*:*:* (Version < 1.3.1.64)

AND

cpe:/h:netgear:r7000p:-:*:*:*:*:*:*:*

Configuration 25:

cpe:/o:netgear:r7800_firmware:*:*:*:*:*:*:*:* (Version < 1.0.2.60)

AND

cpe:/h:netgear:r7800:-:*:*:*:*:*:*:*

Configuration 26:

cpe:/o:netgear:r8900_firmware:*:*:*:*:*:*:*:* (Version < 1.0.4.12)

AND

cpe:/h:netgear:r8900:-:*:*:*:*:*:*:*

Configuration 27:

cpe:/o:netgear:r9000_firmware:*:*:*:*:*:*:*:* (Version < 1.0.4.12)

AND

cpe:/h:netgear:r9000:-:*:*:*:*:*:*:*

Configuration 28:

cpe:/o:netgear:xr500_firmware:*:*:*:*:*:*:*:* (Version < 2.3.2.40)

AND

cpe:/h:netgear:xr500:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:netgear:ex6200v2_firmware:1.0.1:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6220:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:d3600:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:d6000:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:d6200:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:jr6150:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r9000:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r7800:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6120:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6800:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6020:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6260:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6080:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:d7000:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6050:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6700:v2:*:*:*:*:*:*:*

OR cpe:/h:netgear:r6900:v2:*:*:*:*:*:*:*

OR cpe:/h:netgear:pr2000:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:r8900:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:ex7000:-:*:*:*:*:*:*:*

OR cpe:/h:netgear:xr500:-:*:*:*:*:*:*:*

Denotes that component is vulnerable