Vulnerability Details : CVE-2017-6862
NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.
Vulnerability category: OverflowExecute code
Products affected by CVE-2017-6862
- cpe:2.3:o:netgear:wnr2000v5_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:wnr2000v4_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:wnr2000v3_firmware:*:*:*:*:*:*:*:*
CVE-2017-6862 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
NETGEAR Multiple Devices Buffer Overflow Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2017-6862
Added on
2022-06-08
Action due date
2022-06-22
Exploit prediction scoring system (EPSS) score for CVE-2017-6862
58.70%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-6862
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-07 |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | 2025-01-28 |
CWE ids for CVE-2017-6862
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
-
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2017-6862
-
http://www.securityfocus.com/bid/98740
Multiple NETGEAR Routers CVE-2017-6862 Buffer Overflow VulnerabilityBroken Link;Third Party Advisory;VDB Entry
-
https://www.on-x.com/sites/default/files/on-x_-_security_advisory_-_netgear_wnr2000v5_-_cve-2017-6862.pdf
Broken Link
-
https://kb.netgear.com/000038542/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-Some-Routers-PSV-2016-0261
Security Advisory for Unauthenticated Remote Code Execution on Some Routers, PSV-2016-0261 | Answer | NETGEAR SupportVendor Advisory
Jump to