CVE-2017-18858

Vulnerability

The vulnerability exists in the web interface of NETGEAR M4200-10MG-POE+ and M4300 series fully managed switches running firmware version 12.0.2.11 and earlier. An unauthenticated attacker can execute arbitrary commands with administrator privileges. Affected models include GSM4210P, GSM4328S, GSM4352S, GSM4328PS, GSM4352PS, XSM4316S, XSM4324S, XSM4348S, XSM4324CS, and XSM4348CS [1].

Exploitation

An attacker must have network access to the switch's web interface. Typically, a firewall blocks external access, so exploitation is limited to local network or if the management interface is exposed. No authentication is required; the attacker sends specially crafted HTTP requests to trigger command execution [1].

Impact

Successful exploitation allows an unauthenticated attacker to execute commands with administrator privileges, leading to full device compromise. This could result in configuration file disclosure, disruption of switch operation, or complete takeover of the switch [1].

Mitigation

NETGEAR has released firmware fixes for all affected products. Users should update to the latest firmware version available from the NETGEAR Download Center. The advisory strongly recommends immediate firmware update [1].