CVE-2017-18848

Vulnerability

The affected devices are: R6300v2 firmware before 1.0.0.36, AC1450 before 1.0.0.36, R7300 before 1.0.0.54, and R8500 before 1.0.2.94. These routers lack proper CSRF protections, enabling an attacker to craft a request that appears legitimate to the server if the victim is authenticated [1].

Exploitation

An attacker can exploit this by luring an authenticated user to click a crafted link or submit a malicious form while the user is logged into the router's web interface. No authentication is needed for the attacker, but the victim must be currently authenticated to the device.

Impact

Successful exploitation allows the attacker to perform arbitrary actions on the router with the victim's privileges, such as changing administrative settings, modifying DNS configurations, or executing commands. This can lead to full compromise of the device and potential man-in-the-middle attacks on the network.

Mitigation

NETGEAR has released firmware updates to address this vulnerability. Users should update to the latest firmware for their device: R6300v2 to 1.0.0.36 or later, AC1450 to 1.0.0.36 or later, R7300 to 1.0.0.54 or later, and R8500 to 1.0.2.94 or later [1]. No workarounds are provided; updating is strongly recommended.