CVE-2018-21217

Vulnerability

A pre-authentication buffer overflow vulnerability exists in several NETGEAR devices, including the D3600, D6000, D6100, and R6100. The issue affects firmware versions prior to 1.0.0.67 (D3600, D6000), 1.0.0.56 (D6100), and 1.0.1.20 (R6100). The vulnerability can be triggered without authentication, as the overflow occurs before any login or privilege check [1].

Exploitation

An unauthenticated attacker with adjacent network access can exploit this vulnerability. No credentials or user interaction are required. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack is over adjacent network, requires low complexity, and needs no privileges or user interaction [1]. The attacker can send a specially crafted request to the affected device to trigger the buffer overflow.

Impact

Successful exploitation allows an attacker to achieve arbitrary code execution with elevated privileges, potentially gaining full control of the device. This leads to complete compromise of confidentiality, integrity, and availability (CIA) of the affected system [1].

Mitigation

NETGEAR has released fixed firmware versions: D3600 firmware 1.0.0.67, D6000 firmware 1.0.0.67, D6100 firmware 1.0.0.56, and R6100 firmware 1.0.1.20. Users are strongly recommended to download and install the latest firmware for their device from the NETGEAR Support website [1]. No workarounds have been published; patching is the only mitigation.