Quantum Secular Labs / Blog / Advisories

CVE-2018-21134: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.

CVE-2018-21134 is rated critical with a CVSS v3.1 base score of 9.8 and NVD lists 30 affected products, including Netgear R6700 Firmware. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6700 before 1.0.1.48, R7900 before 1.0.2.16, R6900 before 1.0.1.48, R7000P before 1.3.1.44, R6900P before 1.3.1.44, R6250 before 1.0.4.30, R6300v2 before 1.0.4.32, R6400 before 1.0.1.44, R6400v2 before 1.0.2.60, R7000 before 1.0.9.34, R7100LG before 1.0.0.48, R7300 before 1.0.0.68, R8000 before 1.0.4.18, R8000P before 1.4.1.24, R7900P before 1.4.1.24, R8500 before 1.0.2.122, R8300 before 1.0.2.122, WN2500RPv2 before 1.0.1.54, EX3700 before 1.0.0.72, EX3800 before 1.0.0.72, EX6000 before 1.0.0.32, EX6100 before 1.0.2.24, EX6120 before 1.0.0.42, EX6130 before 1.0.0.24, EX6150v1 before 1.0.0.42, EX6200 before 1.0.3.88, EX7000 before 1.0.0.66, D7000v2 before 1.0.0.51, D6220 before 1.0.0.46, D6400 before 1.0.0.82, and D8500 before 1.0.3.42.

Severity breakdown

CVSS v3.1 9.8: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-787: Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Affected products

  • Netgear R6700 Firmware: before 1.0.1.48
  • Netgear R7900 Firmware: before 1.0.2.16
  • Netgear R6900 Firmware: before 1.0.1.48
  • Netgear R7000p Firmware: before 1.3.1.44
  • Netgear R6900p Firmware: before 1.3.1.44
  • Netgear R6250 Firmware: before 1.0.4.30
  • Netgear R6300 Firmware: before 1.0.4.32
  • Netgear R6400 Firmware: before 1.0.1.44; before 1.0.2.60
  • Netgear R7000 Firmware: before 1.0.9.34
  • Netgear R7100lg Firmware: before 1.0.0.48
  • Netgear R7300 Firmware: before 1.0.0.68
  • Netgear R8000 Firmware: before 1.0.4.18
  • Netgear R8000p Firmware: before 1.4.1.24
  • Netgear R7900p Firmware: before 1.4.1.24
  • Netgear R8500 Firmware: before 1.0.2.122

References