CVE-2017-18721

Vulnerability

A stack-based buffer overflow vulnerability exists in the firmware of several NETGEAR router models, including the D6200 (before 1.1.00.24), R6700v2 (before 1.1.0.42), R6800 (before 1.1.0.42), and R6900v2 (before 1.1.0.42). The flaw is triggered during pre-authentication processing, meaning no valid credentials are required to reach the vulnerable code path. An unauthenticated attacker can exploit this by sending a specially crafted packet to the device [1].

Exploitation

An attacker must be on the same network segment as the target device (adjacent network, as indicated by the CVSS vector AV:A). No authentication or user interaction is required. The attacker sends a malicious network packet that overflows a stack buffer, potentially overwriting critical control data. The advisory does not detail the exact protocol or service, but the pre-authentication nature suggests the vulnerability is reachable before any login process [1].

Impact

Successful exploitation allows an unauthenticated attacker to achieve arbitrary code execution on the device. Given the high CVSS scores for confidentiality, integrity, and availability (all rated H), the attacker can likely gain full control of the router, leading to data disclosure, modification, or denial of service [1].

Mitigation

NETGEAR has released firmware updates to address this vulnerability. Users should upgrade to the following fixed versions: D6200 firmware 1.1.00.24, R6700v2 firmware 1.1.0.42, R6800 firmware 1.1.0.42, and R6900v2 firmware 1.1.0.42. No workarounds are provided, and the advisory strongly recommends applying the updates immediately [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.