// For flags

CVE-2019-5017

 

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. An unauthenticated, remote attacker can craft and send a packet containing an opcode that will trigger the kernel module to return several addresses. One of which can be used to calculate the dynamic base address of the module for further exploitation.

Existe una vulnerabilidad explotable de divulgación de información en el módulo de kernel KCodes NetUSB.ko que habilita la funcionalidad de la impresora ReadySHARE de al menos dos routers NETGEAR Nighthawk y posiblemente varios otros proveedores y productos. Un atacante remoto no autenticado puede crear y enviar un paquete que contiene un código de operación que hará que el módulo de kernel devuelva varias direcciones. Uno de los cuales se puede utilizar para calcular la dirección base dinámica del módulo para una mayor explotación.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-01-04 CVE Reserved
  • 2019-06-17 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Netgear
Search vendor "Netgear"
 R8000 Firmware
Search vendor "Netgear" for product "R8000 Firmware"
 1.0.4.28_10.1.54
Search vendor "Netgear" for product "R8000 Firmware" and version "1.0.4.28_10.1.54"
-
Affected
in Netgear
Search vendor "Netgear"
 R8000
Search vendor "Netgear" for product "R8000"
--
Safe
Kcodes
Search vendor "Kcodes"
 Netusb.ko
Search vendor "Kcodes" for product "Netusb.ko"
 1.0.2.66
Search vendor "Kcodes" for product "Netusb.ko" and version "1.0.2.66"
-
Affected