CVE-2017-18773

· MEDIUMModified

← All CVEs

CVSS v3.1

6.7

EPSS

0.56%

Published

Apr 22, 2020

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6100 before V1.0.0.55, D7800 before V1.0.1.24, EX6150v2 before 1.0.0.48, R6100 before 1.0.1.14, R7500 before 1.0.0.110, R7500v2 before V1.0.3.16, R7800 before V1.0.2.36, WNDR4300v1 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, and WNR2000v5 before 1.0.0.48.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-74

Affected Products (22)

netgear · d6100_firmware (up to 1.0.0.55)vulnerable

netgear · d6100

netgear · d7800_firmware (up to 1.0.1.24)vulnerable

netgear · d7800

netgear · ex6150_firmware (up to 1.0.0.48)vulnerable

netgear · ex6150

netgear · r6100_firmware (up to 1.0.1.14)vulnerable

netgear · r6100

netgear · r7500_firmware (up to 1.0.0.110)vulnerable

netgear · r7500

netgear · r7500_firmware (up to 1.0.3.16)vulnerable

netgear · r7500

netgear · r7800_firmware (up to 1.0.2.36)vulnerable

netgear · r7800

netgear · wndr4300_firmware (up to 1.0.2.90)vulnerable

netgear · wndr4300

netgear · wndr4300_firmware (up to 1.0.0.48)vulnerable

netgear · wndr4300

netgear · wndr4500_firmware (up to 1.0.0.48)vulnerable

netgear · wndr4500

netgear · wnr2000_firmware (up to 1.0.0.48)vulnerable

netgear · wnr2000

References (2)

https://kb.netgear.com/000049556/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2184

Vendor Advisory

https://kb.netgear.com/000049556/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-2184

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs