8.8

CVE-2017-18755

Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.4.8, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000P before 1.0.0.86, R6900P before 1.0.0.56, R7300 before 1.0.0.54, R8300 before 1.0.2.106, R8500 before 1.0.2.106, DGN2200v4 before 1.0.0.86, DGND2200Bv4 before 1.0.0.86, R6050 before 1.0.0.86, JR6150 before 1.0.1.10, R6220 before 1.1.0.50, and WNDR3700v5 before V1.1.0.48.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netgear ≫ R6300 Firmware Version < 1.0.4.8
   Netgear ≫ R6300 Version v2
Netgear ≫ R6400 Firmware Version < 1.0.2.32
   Netgear ≫ R6400 Version v2
Netgear ≫ R6700 Firmware Version < 1.0.1.22
   Netgear ≫ R6700 Version -
Netgear ≫ R6900 Firmware Version < 1.0.1.22
   Netgear ≫ R6900 Version -
Netgear ≫ R7000p Firmware Version < 1.0.0.86
   Netgear ≫ R7000p Version -
Netgear ≫ R6900p Firmware Version < 1.0.0.56
   Netgear ≫ R6900p Version -
Netgear ≫ R7300 Firmware Version < 1.0.0.54
   Netgear ≫ R7300 Version -
Netgear ≫ R8300 Firmware Version < 1.0.2.106
   Netgear ≫ R8300 Version -
Netgear ≫ R8500 Firmware Version < 1.0.2.106
   Netgear ≫ R8500 Version -
Netgear ≫ Dgn2200 Firmware Version < 1.0.0.86
   Netgear ≫ Dgn2200 Version v4
Netgear ≫ Dgnd2200b Firmware Version < 1.0.0.86
   Netgear ≫ Dgnd2200b Version v4
Netgear ≫ R6050 Firmware Version < 1.0.0.86
   Netgear ≫ R6050 Version -
Netgear ≫ Jr6150 Firmware Version < 1.0.1.10
   Netgear ≫ Jr6150 Version -
Netgear ≫ R6220 Firmware Version < 1.1.0.50
   Netgear ≫ R6220 Version -
Netgear ≫ Wndr3700 Firmware Version < 1.1.0.48
   Netgear ≫ Wndr3700 Version v5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.363
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
MITRE 8.8 2.8 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://kb.netgear.com/000051493/Security-Advisory-for-Cross-Site-Request-Forgery-on-Routers-and-Modem-Routers-PSV-2017-0333
Vendor Advisory