Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | N/A |
CWE-ID | CWE-20 CWE-77 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software |
MK83 Hardware solutions / Routers & switches, VoIP, GSM, etc MR80 Hardware solutions / Routers & switches, VoIP, GSM, etc MS80 Hardware solutions / Routers & switches, VoIP, GSM, etc R6700v3 Hardware solutions / Routers & switches, VoIP, GSM, etc MK62 Hardware solutions / Routers & switches, VoIP, GSM, etc MR60 Hardware solutions / Routers & switches, VoIP, GSM, etc MS60 Hardware solutions / Routers & switches, VoIP, GSM, etc MK72 Hardware solutions / Routers & switches, VoIP, GSM, etc MR70 Hardware solutions / Routers & switches, VoIP, GSM, etc MS70 Hardware solutions / Routers & switches, VoIP, GSM, etc |
Vendor | NETGEAR |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU77790
Risk: Low
CVSSv4.0: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A local attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMK83: before 1.1.7.12
MR80: before 1.1.7.12
MS80: before 1.1.7.12
R6700v3: before 1.0.4.128
MK62: before 1.1.7.132
MR60: before 1.1.7.132
MS60: before 1.1.7.132
MK72: before 1.0.3.32
MR70: before 1.0.3.32
MS70: before 1.0.3.32
CPE2.3Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU77784
Risk: Low
CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation. A local administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsR6700v3: before 1.0.4.128
CPE2.3 External linksQ & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.