CVE-2017-18757

Vulnerability

A security misconfiguration in the firmware of multiple NETGEAR routers allows unintended access to reserved information or the ability to change the configuration. The affected devices include D7800 before 1.0.1.30, R6100 before 1.0.1.16, R7500 before 1.0.0.116, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, R9000 before 1.0.2.40, WNDR4300v2 before 1.0.0.48, WNDR4300v1 before 1.0.2.90, and WNDR4500v3 before 1.0.0.48 [1].

Exploitation

An attacker on the same local network can exploit this vulnerability without authentication or user interaction. The attack complexity is high, requiring specific conditions or repeated attempts. No privileged access is required, and the attacker does not need to be on the same subnet as the target device [1].

Impact

Successful exploitation results in low confidentiality and integrity impact, meaning the attacker can read reserved information or modify the device configuration. The scope of the impact changes, potentially affecting other components beyond the vulnerable device [1].

Mitigation

NETGEAR has released firmware updates to address this vulnerability. Users should upgrade to the fixed firmware versions as listed: D7800 to 1.0.1.30, R6100 to 1.0.1.16, R7500 to 1.0.0.116, R7500v2 to 1.0.3.20, R7800 to 1.0.2.36, R9000 to 1.0.2.40, WNDR4300v2 to 1.0.0.48, WNDR4300v1 to 1.0.2.90, and WNDR4500v3 to 1.0.0.48 [1].