CNVD-2020-31328

Vulnerability from cnvd - Published: 2020-06-03
VLAI Severity ?
Title
多款NETGEAR产品跨站请求伪造漏洞（CNVD-2020-31328）
Description
NETGEAR D6200等都是美国网件（NETGEAR）公司的产品。NETGEAR D6200是一款无线调制解调器。NETGEAR WNR2020是一款无线路由器。NETGEAR R6220是一款无线路由器。 多款NETGEAR产品中存在跨站请求伪造漏洞，该漏洞源于WEB应用未充分验证请求是否来自可信用户，攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。
Severity
中
Patch Name
多款NETGEAR产品跨站请求伪造漏洞（CNVD-2020-31328）的补丁
Patch Description
NETGEAR D6200等都是美国网件（NETGEAR）公司的产品。NETGEAR D6200是一款无线调制解调器。NETGEAR WNR2020是一款无线路由器。NETGEAR R6220是一款无线路由器。 多款NETGEAR产品中存在跨站请求伪造漏洞，该漏洞源于WEB应用未充分验证请求是否来自可信用户，攻击者可利用该漏洞通过受影响客户端向服务器发送非预期的请求。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://kb.netgear.com/000049537/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2017-2953

Reference
https://nvd.nist.gov/vuln/detail/CVE-2017-18782
Impacted products
Name
['NETGEAR D6200 <1.1.00.24', 'NETGEAR R6120 <1.0.0.36', 'NETGEAR R6020 <1.0.0.26', 'NETGEAR R6080 <1.0.0.26', 'NETGEAR R6220 <1.1.0.60', 'NETGEAR JNR1010v2 <1.1.0.44', 'NETGEAR JR6150 <1.0.1.12', 'NETGEAR JWNR2010v5 <1.1.0.44', 'NETGEAR PR2000 <1.0.0.20', 'NETGEAR R6050 <1.0.1.12', 'NetGear WNR1000v4 <1.1.0.44', 'NETGEAR WNR2020 <1.1.0.44', 'NETGEAR WNR2050 <1.1.0.44', 'NETGEAR D7000 <1.0.1.52', 'NETGEAR R6800 <1.2.0.12', 'NETGEAR R6900v2 <1.2.0.12', 'NETGEAR R6700v2 <1.2.0.12', 'NETGEAR WNDR3700v5 <1.1.0.50']
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-18782"
    }
  },
  "description": "NETGEAR D6200\u7b49\u90fd\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08NETGEAR\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002NETGEAR D6200\u662f\u4e00\u6b3e\u65e0\u7ebf\u8c03\u5236\u89e3\u8c03\u5668\u3002NETGEAR WNR2020\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002NETGEAR R6220\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002\n\n\u591a\u6b3eNETGEAR\u4ea7\u54c1\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u672a\u5145\u5206\u9a8c\u8bc1\u8bf7\u6c42\u662f\u5426\u6765\u81ea\u53ef\u4fe1\u7528\u6237\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d7\u5f71\u54cd\u5ba2\u6237\u7aef\u5411\u670d\u52a1\u5668\u53d1\u9001\u975e\u9884\u671f\u7684\u8bf7\u6c42\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://kb.netgear.com/000049537/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2017-2953",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-31328",
  "openTime": "2020-06-03",
  "patchDescription": "NETGEAR D6200\u7b49\u90fd\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08NETGEAR\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002NETGEAR D6200\u662f\u4e00\u6b3e\u65e0\u7ebf\u8c03\u5236\u89e3\u8c03\u5668\u3002NETGEAR WNR2020\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002NETGEAR R6220\u662f\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002\r\n\r\n\u591a\u6b3eNETGEAR\u4ea7\u54c1\u4e2d\u5b58\u5728\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eWEB\u5e94\u7528\u672a\u5145\u5206\u9a8c\u8bc1\u8bf7\u6c42\u662f\u5426\u6765\u81ea\u53ef\u4fe1\u7528\u6237\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u53d7\u5f71\u54cd\u5ba2\u6237\u7aef\u5411\u670d\u52a1\u5668\u53d1\u9001\u975e\u9884\u671f\u7684\u8bf7\u6c42\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eNETGEAR\u4ea7\u54c1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff08CNVD-2020-31328\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "NETGEAR D6200 \u003c1.1.00.24",
      "NETGEAR R6120 \u003c1.0.0.36",
      "NETGEAR R6020 \u003c1.0.0.26",
      "NETGEAR R6080 \u003c1.0.0.26",
      "NETGEAR R6220 \u003c1.1.0.60",
      "NETGEAR JNR1010v2 \u003c1.1.0.44",
      "NETGEAR JR6150 \u003c1.0.1.12",
      "NETGEAR JWNR2010v5 \u003c1.1.0.44",
      "NETGEAR PR2000 \u003c1.0.0.20",
      "NETGEAR R6050 \u003c1.0.1.12",
      "NetGear WNR1000v4 \u003c1.1.0.44",
      "NETGEAR WNR2020 \u003c1.1.0.44",
      "NETGEAR WNR2050 \u003c1.1.0.44",
      "NETGEAR D7000 \u003c1.0.1.52",
      "NETGEAR R6800 \u003c1.2.0.12",
      "NETGEAR R6900v2 \u003c1.2.0.12",
      "NETGEAR R6700v2 \u003c1.2.0.12",
      "NETGEAR WNDR3700v5 \u003c1.1.0.50"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-18782",
  "serverity": "\u4e2d",
  "submitTime": "2020-04-23",
  "title": "\u591a\u6b3eNETGEAR\u4ea7\u54c1\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020\u6f0f\u6d1e\uff08CNVD-2020-31328\uff09"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.