CVE-2018-21120

published 2020-04-22

CVE-2018-21120: Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4…

Priority P3 38 high 8 CVSS 3.1

AV N AC L PR L UI R S U C H I H A H

Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4, WNAP210v2 before 3.7.11.4, WNDAP350 before 3.7.11.4, WNDAP360 before 3.7.11.4, WNDAP660 before 3.7.11.4, WNDAP620 before 2.1.7, WND930 before 2.1.5, and WN604 before 3.3.10.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
netgear	wac120_firmware	< 2.1.7	2.1.7
netgear	wac505_firmware	< 5.0.5.4	5.0.5.4
netgear	wac510_firmware	< 5.0.5.4	5.0.5.4
netgear	wn604_firmware	< 3.3.10	3.3.10
netgear	wnap210_firmware	< 3.7.11.4	3.7.11.4
netgear	wnap320_firmware	< 3.7.11.4	3.7.11.4
netgear	wnd930_firmware	< 2.1.5	2.1.5
netgear	wndap350_firmware	< 3.7.11.4	3.7.11.4
netgear	wndap360_firmware	< 3.7.11.4	3.7.11.4
netgear	wndap620_firmware	< 2.1.7	2.1.7
netgear	wndap660_firmware	< 3.7.11.4	3.7.11.4

CVSS provenance

nvd v3.1 8.0 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

nvd v3.0 5.2 MEDIUM CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

nvd v2.0 6.0 MEDIUM AV:N/AC:M/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352