Lucene search

MitreCVE-2017-18844

HistoryApr 20, 2020 - 4:15 p.m.

CVE-2017-18844

2020-04-2016:15:13

CWE-522

mitre

web.nvd.nist.gov

netgear

devices

admin credentials

disclosure

cve-2017-18844

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before 1.0.1.50.

Affected configurations

Nvd

Node

netgearr6700_firmwareRange<1.1.0.38

AND

netgearr6700Matchv2

Node

netgearr6800_firmwareRange<1.1.0.38

AND

netgearr6800Match-

Node

netgeard7000_firmwareRange<1.0.1.50

AND

netgeard7000Match-

VendorProductVersionCPE
netgearr6700_firmware*cpe:2.3:o:netgear:r6700_firmware:*:*:*:*:*:*:*:*
netgearr6700v2cpe:2.3:h:netgear:r6700:v2:*:*:*:*:*:*:*
netgearr6800_firmware*cpe:2.3:o:netgear:r6800_firmware:*:*:*:*:*:*:*:*
netgearr6800-cpe:2.3:h:netgear:r6800:-:*:*:*:*:*:*:*
netgeard7000_firmware*cpe:2.3:o:netgear:d7000_firmware:*:*:*:*:*:*:*:*
netgeard7000-cpe:2.3:h:netgear:d7000:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgear	r6700_firmware	*	cpe:2.3:o:netgear:r6700_firmware::::::::
netgear	r6700	v2	cpe:2.3:h:netgear:r6700:v2:::::::*
netgear	r6800_firmware	*	cpe:2.3:o:netgear:r6800_firmware::::::::
netgear	r6800	-	cpe:2.3:h:netgear:r6800:-:::::::*
netgear	d7000_firmware	*	cpe:2.3:o:netgear:d7000_firmware::::::::
netgear	d7000	-	cpe:2.3:h:netgear:d7000:-:::::::*

References

kb.netgear.com/000049015/Security-Advisory-for-an-Admin-Credential-Disclosure-on-Some-Routers-PSV-2017-2149

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2017-18844