CVE-2017-18832

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the web management interface of certain NETGEAR fully managed switches. Affected models include M4300-28G, M4300-52G, M4300-28G-POE+, M4300-52G-POE+, M4300-8X8F, M4300-12X12F, M4300-24X24F, M4300-24X, M4300-48X, and M4200, all running firmware versions prior to 12.0.2.15 [1]. The vulnerability is present in the administrative web UI and can be exploited when an attacker with high privileges (administrator level) injects malicious script content via input fields that are later served to other users.

Exploitation

An attacker must first obtain authenticated access to the switch's web management interface with administrative-level credentials (CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L [1]). Once logged in, the attacker can inject malicious JavaScript or HTML into input fields that are stored and later rendered without proper sanitization. Successful exploitation requires that another administrator (or a user with sufficient privileges) views the affected page, triggering the stored payload. The attacker does not require physical access; the attack vector is local (logical) to the management interface.

Impact

If the stored XSS payload is executed, the attacker can perform actions within the context of the victim's session, such as modifying switch configuration, exfiltrating sensitive data displayed in the web UI (e.g., credentials or network topology), or redirecting the victim to malicious sites. The CVSS v3 score is 5.2 (Medium), with low impact to confidentiality, integrity, and availability per the CVSS vector [1].

Mitigation

NETGEAR released fixed firmware version 12.0.2.15 for all affected models. Users should download and install the latest firmware from the NETGEAR Support site as soon as possible [1]. No workarounds are documented; the vendor states the vulnerability remains if the recommended firmware update is not applied [1]. None of the affected models are listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.