CVE-2017-18825

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web interface of multiple NETGEAR fully managed switch models, including M4300-28G, M4300-52G, M4300-28G-POE+, M4300-52G-POE+, M4300-8X8F, M4300-12X12F, M4300-24X24F, M4300-24X, M4300-48X, and M4200, all running firmware versions prior to 12.0.2.15 [1]. The stored XSS allows an attacker to inject arbitrary web script or HTML that is persistently stored on the device and later rendered in the management interface.

Exploitation

Exploitation requires an attacker with high privileges (administrative access) to the device's management interface and user interaction, as the CVSS vector AV:L/AC:L/PR:H/UI:R indicates [1]. The attacker would need to inject malicious script into a stored field (e.g., configuration parameters) via the web interface. When another administrator or user views the affected page, the script executes in their browser context.

Impact

Successful exploitation could lead to partial compromise of confidentiality, integrity, and availability (CVSS v3 base score 5.2, Medium) [1]. The attacker could potentially perform actions within the context of the victim's session, such as altering device settings or exfiltrating sensitive information displayed in the management interface.

Mitigation

The vulnerability is fixed in firmware version 12.0.2.15 for all affected models [1]. Users should update to the latest firmware via NETGEAR Support. No workaround is described; the vendor strongly recommends applying the update.