Input validation error in NETGEAR products - #VU64815

Vulnerability identifier: #VU64815

CSH Severity: Low

CVSS v4: 6 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-20

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

EX6130
EX6120
EX3700
EX3800
RAX40v2
RAX43
RAX50
RAX45
RAX15
RAX35v2
RAX38v2
RAX20
R6700v3
RAX200
RAX80
RAX75
RAXE500
RAXE450
MK82
MR80
MS80
LAX20
MK62
MR60
MS60
CAX80
XR1000
R6400v2
R7000
R7000P

Install updates from vendor's website.

EX6130 - update to 1.0.0.46
XR1000 - update to 1.0.0.58
EX6120 - update to 1.0.0.66
EX3700 - update to 1.0.0.94
EX3800 - update to 1.0.0.94
RAX40v2 - update to 1.0.4.100
RAX43 - update to 1.0.4.100
RAX50 - update to 1.0.4.100
RAX45 - update to 1.0.4.100
RAX15 - update to 1.0.4.100
RAX35v2 - update to 1.0.4.100
RAX38v2 - update to 1.0.4.100
RAX20 - update to 1.0.4.100
R6400v2 - update to 1.0.4.118
R6700v3 - update to 1.0.4.118
RAX200 - update to 1.0.5.126
RAX80 - update to 1.0.5.126
RAX75 - update to 1.0.5.126
RAXE500 - update to 1.0.8.70
RAXE450 - update to 1.0.8.70
R7000 - update to 1.0.11.126
MK82 - update to 1.1.6.14
MR80 - update to 1.1.6.14
MS80 - update to 1.1.6.14
LAX20 - update to 1.1.6.30
MK62 - update to 1.1.6.122
MR60 - update to 1.1.6.122
MS60 - update to 1.1.6.122
R7000P - update to 1.3.3.140
CAX80 - update to 2.1.3.5

• https://kb.netgear.com/000065042/Security-Advisory-for-Denial-of-Service-on-Some-Routers-and-WiFi-Systems-PSV-2021-0141

• Denial of service in NETGEAR Routers and WiFi Systems