CVE-2017-18851 — Injection in Netgear D8500 Firmware

CWE-74 — Injection3 documents3 sources
Severity
6.7MEDIUMNVD
EPSS
0.1%
top 75.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Netgear D8500 FirmwareNetgear R6100 FirmwareNetgear R6400 Firmware+2 more
Timeline
PublishedApr 20
Latest updateMay 24

Description

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D8500 through 1.0.3.28, R6400 through 1.0.1.22, R6400v2 through 1.0.2.18, R8300 through 1.0.2.94, R8500 through 1.0.2.94, and R6100 through 1.0.1.12.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages5 packages

▶NVDnetgear/d8500_firmware< 1.0.3.28
▶NVDnetgear/r6100_firmware< 1.0.1.12
▶NVDnetgear/r6400_firmware< 1.0.1.22+1
▶NVDnetgear/r8300_firmware< 1.0.2.94
▶NVDnetgear/r8500_firmware< 1.0.2.94

🔴Vulnerability Details

2
GHSA
GHSA-hq7r-pxqp-4g8p: Certain NETGEAR devices are affected by command injection by an authenticated user↗2022-05-24
▶
CVEList
CVE-2017-18851: Certain NETGEAR devices are affected by command injection by an authenticated user↗2020-04-20
▶
CVE-2017-18851 — Injection in Netgear D8500 Firmware | cvebase