CVE-2017-18853

Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.27 and earlier, DGN2200v4 1.0.0.82 and earlier, R6300v2 1.0.4.06 and earlier, R6400 1.0.1.20 and earlier, R6400v2 1.0.2.18 and earlier, R6700 1.0.1.22 and earlier, R6900 1.0.1.20 and earlier, R7000 1.0.7.10 and earlier, R7000P 1.0.0.58 and earlier, R7100LG 1.0.0.28 and earlier, R7300DST 1.0.0.52 and earlier, R7900 1.0.1.12 and earlier, R8000 1.0.3.46 and earlier, R8300 1.0.2.86 and earlier, R8500 1.0.2.86 and earlier, WNDR3400v3 1.0.1.8 and earlier, and WNDR4500v2 1.0.0.62 and earlier.

Published: Apr 29, 2020
Updated: Nov 9, 2025
CVE: CVE-2017-18853
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.5
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-200

Affected Software
References

Software	From	Fixed in
netgear / d8500_firmware	-	1.0.3.27.x
netgear / dgn2200_firmware	-	1.0.0.82.x
netgear / r6300_firmware	-	1.0.4.06.x
netgear / r6400_firmware	-	1.0.1.20.x
netgear / r6400_firmware	-	1.0.2.18.x
netgear / r6700_firmware	-	1.0.1.22.x
netgear / r6900_firmware	-	1.0.1.20.x
netgear / r7000_firmware	-	1.0.7.10.x
netgear / r7000p_firmware	-	1.0.0.58.x
netgear / r7100lg_firmware	-	1.0.0.28.x
netgear / r7300dst_firmware	-	1.0.0.52.x
netgear / r7900_firmware	-	1.0.1.12.x
netgear / r8000_firmware	-	1.0.3.46.x
netgear / r8300_firmware	-	1.0.2.86.x
netgear / r8500_firmware	-	1.0.2.86.x
netgear / wndr3400_firmware	-	1.0.1.8.x
netgear / wndr4500_firmware	-	1.0.0.62.x

https://kb.netgear.com/000045848/Security-Advisory-for-Password-Recovery-and-File-Access-on-Some-Routers-and-Modem-Routers-PSV-2017-0677

Vulnerability Database

302,156

CVE-2017-18853

Deep Security Visibility Without the Complexity