CVE-2017-18755

Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.4.8, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000P before 1.0.0.86, R6900P before 1.0.0.56, R7300 before 1.0.0.54, R8300 before 1.0.2.106, R8500 before 1.0.2.106, DGN2200v4 before 1.0.0.86, DGND2200Bv4 before 1.0.0.86, R6050 before 1.0.0.86, JR6150 before 1.0.1.10, R6220 before 1.1.0.50, and WNDR3700v5 before V1.1.0.48.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitreCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:R
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
VendorProductVersion
netgearr6300_firmware
𝑥
< 1.0.4.8
netgearr6400_firmware
𝑥
< 1.0.2.32
netgearr6700_firmware
𝑥
< 1.0.1.22
netgearr6900_firmware
𝑥
< 1.0.1.22
netgearr7000p_firmware
𝑥
< 1.0.0.86
netgearr6900p_firmware
𝑥
< 1.0.0.56
netgearr7300_firmware
𝑥
< 1.0.0.54
netgearr8300_firmware
𝑥
< 1.0.2.106
netgearr8500_firmware
𝑥
< 1.0.2.106
netgeardgn2200_firmware
𝑥
< 1.0.0.86
netgeardgnd2200b_firmware
𝑥
< 1.0.0.86
netgearr6050_firmware
𝑥
< 1.0.0.86
netgearjr6150_firmware
𝑥
< 1.0.1.10
netgearr6220_firmware
𝑥
< 1.1.0.50
netgearwndr3700_firmware
𝑥
< 1.1.0.48
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://kb.netgear.com/000051493/Security-Advisory-for-Cross-Site-Request-Forgery-on-Routers-and-Modem-Routers-PSV-2017-0333
https://kb.netgear.com/000051493/Security-Advisory-for-Cross-Site-Request-Forgery-on-Routers-and-Modem-Routers-PSV-2017-0333