Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-18851: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D8500 through 1.0.3.28, R6400 through 1.0.1.22, R6400v2 through 1.0.2.18, R8300 through 1.0.2.94, R8...

CVE-2017-18851 · published 6 years ago

Summary

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D8500 through 1.0.3.28, R6400 through 1.0.1.22, R6400v2 through 1.0.2.18, R8300 through 1.0.2.94, R8500 through 1.0.2.94, and R6100 through 1.0.1.12.

What to do

Update netgear d8500_firmware to version 1.0.3.28 or later.
Update netgear r8300_firmware to version 1.0.2.94 or later.
Update netgear r8500_firmware to version 1.0.2.94 or later.
Update netgear r6100_firmware to version 1.0.1.12 or later.

Affected software

Vendor	Product	Affected versions
netgear	d8500_firmware	< 1.0.3.28 `cpe:2.3:o:netgear:d8500_firmware::::::::`
netgear	r6400_firmware	< 1.0.1.22 < 1.0.2.18 `cpe:2.3:o:netgear:r6400_firmware::::::::`
netgear	r8300_firmware	< 1.0.2.94 `cpe:2.3:o:netgear:r8300_firmware::::::::`
netgear	r8500_firmware	< 1.0.2.94 `cpe:2.3:o:netgear:r8500_firmware::::::::`
netgear	r6100_firmware	< 1.0.1.12 `cpe:2.3:o:netgear:r6100_firmware::::::::`

Original advisory text

References

https://kb.netgear.com/000045850/Security-Advisory-for-Post-Authentication-Comma... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.7 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-74Injection

Timeline

Published20 Apr 2020

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-18851 · NVD

Track software like this

Free during beta