Vulnerability identifier: #VU85062

Vulnerability risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-121

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
MR80
Hardware solutions / Routers & switches, VoIP, GSM, etc
MS80
Hardware solutions / Routers & switches, VoIP, GSM, etc
MK82
Hardware solutions / Routers & switches, VoIP, GSM, etc
CBR750
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBRE960
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBSE960
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBKE962
Hardware solutions / Routers & switches, VoIP, GSM, etc
MR70
Hardware solutions / Routers & switches, VoIP, GSM, etc
MS70
Hardware solutions / Routers & switches, VoIP, GSM, etc
MK72
Hardware solutions / Routers & switches, VoIP, GSM, etc
MR60
Hardware solutions / Routers & switches, VoIP, GSM, etc
MS60
Hardware solutions / Routers & switches, VoIP, GSM, etc
MK62
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX38v2
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX48
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX43
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX50
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX35v2
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX45
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX40v2
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX50S
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAX42
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAXE500
Hardware solutions / Routers & switches, VoIP, GSM, etc
RAXE450
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBR750
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBS750
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBK752
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBR850
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBS850
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBK852
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBR840
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBS840
Hardware solutions / Routers & switches, VoIP, GSM, etc
RBK842
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor:

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A local administrator attacker can trigger stack-based buffer overflow and cause a denial of service condition on the target system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

---

External links
http://kb.netgear.com/000065939/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2019-0222

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.