CVE-2017-18854

Vulnerability

NETGEAR ReadyNAS OS 6 storage systems running version 6.6.1 or earlier are affected by an operating system command injection vulnerability [1]. The flaw exists in the web interface and can be triggered by an authenticated attacker with administrator credentials [1].

Exploitation

An attacker must have access to the local area network and possess valid administrator credentials for the ReadyNAS device [1]. With these privileges, the attacker can inject arbitrary OS commands through the vulnerable interface, leading to execution on the underlying system [1].

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands with high privileges, resulting in full compromise of confidentiality, integrity, and availability of the storage system [1]. The CVSS v3 score is 6.7 (Medium) [1].

Mitigation

NETGEAR released ReadyNAS OS version 6.6.2 which fixes this vulnerability [1]. All affected users should upgrade to 6.6.2 or later immediately [1]. No workarounds are available [1].