CVE-2018-21182

Vulnerability

A stack-based buffer overflow vulnerability exists in the web interface of certain NETGEAR routers. An authenticated user can trigger a stack overflow by sending a crafted request. Affected models include R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.92, and WNDR4300 before 1.0.2.94. The issue is tracked as PSV-2017-2617 and requires prior authentication to the router's management interface [1].

Exploitation

An attacker must have valid credentials to log into the router's web interface. Once authenticated, they can send a specially crafted request that exploits the stack overflow. No additional user interaction is required. The attack can be launched from the local network (adjacent network) due to the CVSS vector [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the device with root privileges. This results in full compromise of the router, including potential data exfiltration, further network attacks, and device takeover [1].

Mitigation

NETGEAR has released fixed firmware versions for all affected models: R7800 version 1.0.2.40, R9000 version 1.0.2.52, WNDR3700v4 version 1.0.2.92, and WNDR4300 version 1.0.2.94. Users should update to the latest firmware immediately via the NETGEAR Support website [1].