Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-21208: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6100 before 1.0.0.57, R6100 before 1.0.1.20, R7500v2 before 1.0.3.24, WNDR4300v2 before 1.0.0...

CVE-2018-21208 · published 6 years ago

Summary

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6100 before 1.0.0.57, R6100 before 1.0.1.20, R7500v2 before 1.0.3.24, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50.

What to do

Update netgear d6100_firmware to version 1.0.0.57 or later.
Update netgear r6100_firmware to version 1.0.1.20 or later.
Update netgear r7500_firmware to version 1.0.3.24 or later.
Update netgear wndr4300_firmware to version 1.0.0.50 or later.
Update netgear wndr4500_firmware to version 1.0.0.50 or later.

Affected software

Vendor	Product	Affected versions
netgear	d6100_firmware	< 1.0.0.57 `cpe:2.3:o:netgear:d6100_firmware::::::::`
netgear	r6100_firmware	< 1.0.1.20 `cpe:2.3:o:netgear:r6100_firmware::::::::`
netgear	r7500_firmware	< 1.0.3.24 `cpe:2.3:o:netgear:r7500_firmware::::::::`
netgear	wndr4300_firmware	< 1.0.0.50 `cpe:2.3:o:netgear:wndr4300_firmware::::::::`
netgear	wndr4500_firmware	< 1.0.0.50 `cpe:2.3:o:netgear:wndr4500_firmware::::::::`

Original advisory text

References

https://kb.netgear.com/000055141/Security-Advisory-for-Pre-Authentication-Comman... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

1% chance of attack within 30 days

Type

CWE-74Injection

Timeline

Published28 Apr 2020

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-21208 · NVD

Track software like this

Free during beta