CVE-2018-21134

Vulnerability

CVE-2018-21134 is a pre-authentication stack-based buffer overflow vulnerability affecting a wide range of NETGEAR routers, wireless extenders, and other devices. The flaw exists in the firmware's handling of certain network requests before authentication, allowing an unauthenticated attacker to trigger a stack overflow. Affected devices include models such as R6700 (before 1.0.1.48), R7900 (before 1.0.2.16), R6900 (before 1.0.1.48), R7000P (before 1.3.1.44), and many others listed in the official advisory [1]. The complete list spans over 30 firmware versions across router and extender product lines.

Exploitation

An unauthenticated attacker can exploit this vulnerability from the local network by sending specially crafted packets to the affected device, without requiring any authentication or user interaction. The advisory describes the issue as a pre-authentication stack overflow, meaning the attacker does not need valid credentials to reach the vulnerable code path [1]. The exploitation vector is network-based, targeting the device's management interface or other exposed services.

Impact

Successful exploitation allows an attacker to potentially execute arbitrary code on the device, gaining full control over the affected router or extender. This can lead to disclosure of sensitive network traffic, persistence, and further compromise of the local network. The vulnerability requires no privileges and can be triggered remotely, making it a critical risk for unpatched devices.

Mitigation

NETGEAR has released firmware updates addressing this vulnerability for all listed models [1]. The fixed versions are specified in the advisory: for example, R6700 must be updated to version 1.0.1.48 or later. Users should upgrade to the latest available firmware for their device as soon as possible. No workarounds are provided; the only mitigation is to install the patched firmware. The advisory does not indicate that this CVE is listed in the KEV catalog.