CVE-2017-18764

Vulnerability

CVE-2017-18764 is a pre-authentication command injection vulnerability in the web interface of numerous NETGEAR devices. An unauthenticated attacker can inject arbitrary operating system commands via a crafted HTTP request. The following models are affected: D6100 before 1.0.0.55, D7000 before 1.0.1.50, D7800 before 1.0.1.28, JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.44, PR2000 before 1.0.0.18, R6050 before 1.0.1.10, R6100 before 1.0.1.14, R6120 before 1.0.0.30, R6220 before 1.1.0.50, R6700v2 before 1.2.0.4, R6800 before 1.2.0.4, R6900v2 before 1.2.0.4, R7500 before 1.0.0.110, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, R9000 before 1.0.2.52, WN3000RPv3 before 1.0.2.50, WNDR3700v4 before 1.0.2.88, WNDR3700v5 before 1.1.0.48, WNDR4300v1 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.44, WNR2000v5 before 1.0.0.58, WNR2020 before 1.1.0.44, and WNR2050 before 1.1.0.44 [1].

Exploitation

An attacker does not need authentication or any prior access to the device. The vulnerability can be triggered by sending a specially crafted HTTP request to the web management interface of an affected NETGEAR device [1]. No user interaction is required, and no specific network position beyond network reachability to the device is needed; however, the device typically listens on the local network (LAN), so an attacker must be on the same subnet or have network access to the management interface.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the underlying operating system with root privileges, because the web server runs with elevated permissions. This gives the attacker full control over the device, including the ability to modify configuration, intercept network traffic, and launch further attacks against the local network [1].

Mitigation

NETGEAR released fixed firmware versions for all affected models as of the advisory date. The firmware versions listed in the Vulnerability section represent the patched releases. Users should update their device firmware to the latest version immediately via NETGEAR Support [1]. No workarounds are provided, and the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Devices that have reached end-of-life (EOL) may not receive a fix.