NETGEAR · Multiple Devices
CVE-2017-6862
NETGEAR Multiple Devices Buffer Overflow Vulnerability
What it is
NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.
CISA: Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: June 22, 2022
More exploited flaws from NETGEAR
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 8, 2022 | Exposure of Sensitive Information | Multiple Devices | High 8.1 | 89% |
| Mar 25, 2022 | Multiple WAP Devices Command Injection | Wireless Access Point (WAP) Devices | Critical 9.8 | 98% |
| Mar 25, 2022 | OS Command Injection | DGN2200 Devices | High 8.8 | 73% |
| Mar 25, 2022 | Buffer Overflow | WNR2000v5 Router | Critical 9.8 | 83% |
| Mar 7, 2022 | Remote Code Execution | Multiple Routers | High 8.8 | 99.8% |
| Mar 7, 2022 | DGN2200 Remote Code Execution | Wireless Router DGN2200 | Critical 9.8 | 69% |
| Nov 3, 2021 | Missing Function Level Access Control | JGS516PE Devices | Critical 9.8 | 57% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.