Details of VAR-202308-3782

ID

VAR-202308-3782

CVE

CVE-2023-38921

TITLE

of netgear wg302v2 firmware and wag302v2 Command injection vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2023-024484

DESCRIPTION

Netgear WG302v2 v5.2.9 and WAG302v2 v5.1.19 were discovered to contain multiple command injection vulnerabilities in the upgrade_handler function via the firmwareRestore and firmwareServerip parameters. of netgear wg302v2 firmware and wag302v2 Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2023-38921 // JVNDB: JVNDB-2023-024484

AFFECTED PRODUCTS

vendor:	netgear	model:	wag302v2	scope:	eq	version:	5.1.19	Trust: 1.0
vendor:	netgear	model:	wg302v2	scope:	eq	version:	5.2.9	Trust: 1.0
vendor:	ネットギア	model:	wag302v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	wg302v2	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-024484 // NVD: CVE-2023-38921

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2023-38921
value:	HIGH
Trust: 1.0
NVD:	CVE-2023-38921
value:	HIGH
Trust: 0.8

nvd@nist.gov:	CVE-2023-38921
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2023-38921
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-024484 // NVD: CVE-2023-38921

PROBLEMTYPE DATA

problemtype:	CWE-77	Trust: 1.0
problemtype:	Command injection (CWE-77) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-024484 // NVD: CVE-2023-38921

EXTERNAL IDS

db:	NVD	id:	CVE-2023-38921	Trust: 2.6
db:	JVNDB	id:	JVNDB-2023-024484	Trust: 0.8

sources: JVNDB: JVNDB-2023-024484 // NVD: CVE-2023-38921

REFERENCES

url:	https://github.com/firmrec/iot-vulns/tree/main/netgear/upgrade_handler	Trust: 1.8
url:	https://www.netgear.com/about/security/	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2023-38921	Trust: 0.8

sources: JVNDB: JVNDB-2023-024484 // NVD: CVE-2023-38921

SOURCES

db:	JVNDB	id:	JVNDB-2023-024484
db:	NVD	id:	CVE-2023-38921

LAST UPDATE DATE

2024-08-14T13:41:34.234000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2023-024484	date:	2024-01-31T07:56:00
db:	NVD	id:	CVE-2023-38921	date:	2023-08-09T18:03:20.593

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2023-024484	date:	2024-01-31T00:00:00
db:	NVD	id:	CVE-2023-38921	date:	2023-08-07T19:15:10.393