CVE-2017-18842

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in several NETGEAR devices, including R7300 before firmware version 1.0.0.54, R8500 before 1.0.2.94, DGN2200v1 before 1.0.0.55, and D2200D/D2200DW-1FRNAS before 1.0.0.32 [1]. The issue allows an attacker to perform unauthorized actions on the device's web interface by tricking an authenticated user into clicking a malicious link or visiting a crafted page.

Exploitation

To exploit this vulnerability, an attacker must craft a malicious request that targets the device's web interface and then convince an authenticated user to execute it, typically by clicking a link or visiting a specially crafted website. No additional network access or authentication is required beyond the user's existing session [1].

Impact

Successful exploitation can lead to arbitrary actions being performed on the device, including modifying settings, disclosing sensitive information, or potentially executing commands. The CVSS v3 score of 8.8 indicates high impact on confidentiality, integrity, and availability [1].

Mitigation

NETGEAR has released firmware updates to address the vulnerability: R7300 version 1.0.0.54, R8500 version 1.0.2.94, DGN2200v1 version 1.0.0.55, and D2200D/D2200DW-1FRNAS version 1.0.0.32. Users should update their devices to the latest firmware as recommended by the vendor [1].