CVE-2017-18750

Vulnerability

A stack-based buffer overflow vulnerability exists in certain NETGEAR devices, including D6200 before firmware version 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42. The flaw is present in a pre-authentication code path and can be triggered without any authentication [1].

Exploitation

An unauthenticated attacker on the same adjacent network can craft a malicious network request to exploit this stack overflow. The attack requires no privileges and no user interaction, with low complexity [1]. The exploit involves sending a carefully crafted payload to cause a buffer overflow.

Impact

Successful exploitation allows the attacker to execute arbitrary code with high impact on confidentiality, integrity, and availability. The CVSS v3 score is 8.8 (High), indicating full compromise of the affected device [1].

Mitigation

NETGEAR has released firmware fixes for all affected models. Users should upgrade D6200 to version 1.1.00.24, and R6700v2, R6800, and R6900v2 to version 1.1.0.42 [1]. No workaround is available; installing the latest firmware is the only mitigation.