CVE-2018-11106

CRITICAL

9.8

Description

NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie4/1/2020

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

netgear:wc7500netgear:wc7500_firmwarenetgear:wc7520netgear:wc7520_firmwarenetgear:wc7600v1netgear:wc7600v1_firmwarenetgear:wc7600v2netgear:wc7600v2_firmwarenetgear:wc9500netgear:wc9500_firmware

Faiblesses (CWE)

CWE-77

References

https://kb.netgear.com/000058243/Security-Advisory-for-Pre-Authentication-Command-Injection-in-request-handler-php-on-Some-Wireless-Controllers-PSV-2018-0051(a2826606-91e7-4eb6-899e-8484bd4575d5)

https://kb.netgear.com/000058243/Security-Advisory-for-Pre-Authentication-Command-Injection-in-request-handler-php-on-Some-Wireless-Controllers-PSV-2018-0051(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.