CVE-2017-18835

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in the web interface of various NETGEAR fully managed switches, including M4300-28G, M4300-52G, M4300-28G-POE+, M4300-52G-POE+, M4300-8X8F, M4300-12X12F, M4300-24X24F, M4300-24X, M4300-48X, and M4200, running firmware versions prior to 12.0.2.15 [1]. The vulnerability allows an attacker to inject malicious script into a web page that is reflected back to the user.

Exploitation

The attacker can exploit this vulnerability by sending a crafted URL to a logged-in user and convincing them to click on it. The attacker does not require authentication or network access beyond the ability to deliver the malicious link. User interaction is necessary for the attack to succeed.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to disclosure of sensitive information, session hijacking, or other malicious actions. The CVSS v3 score is 6.1 (Medium) with a vector of AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Mitigation

NETGEAR has released firmware version 12.0.2.15 to address this vulnerability. Users should upgrade to this version or later as soon as possible. The fixed firmware is available for download from NETGEAR Support [1]. There is no known workaround.