CVE-2018-21177

Vulnerability

A post-authentication stack-based buffer overflow vulnerability exists in several NETGEAR routers and gateways. The flaw occurs when an authenticated user sends a specially crafted request to the device, corrupting the stack. Affected devices include D6100 (before 1.0.0.57), R6100 (before 1.0.1.20), R7800 (before 1.0.2.40), R9000 (before 1.0.2.52), WNDR3700v4 (before 1.0.2.92), WNDR4300 (before 1.0.2.94), WNDR4300v2 (before 1.0.0.50), WNDR4500v3 (before 1.0.0.50), and WNR2000v5 (before 1.0.0.62) [1].

Exploitation

An attacker must first authenticate to the device (requiring valid credentials). With network adjacency (CVSS:3.0/AV:A), the attacker sends a tailored request that triggers the overflow. The exploitation does not require user interaction, but the attacker needs high privileges (PR:H) [1].

Impact

Successful exploitation can lead to arbitrary code execution with elevated privileges, resulting in full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) [1].

Mitigation

NETGEAR has released firmware updates for all affected models. Users should upgrade to the latest firmware versions as specified in the advisory [1]. If upgrading is not immediately possible, limit administrative access to trusted users and networks.