CVE-2018-21152

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R8900 before 1.0.3.10, R9000 before 1.0.3.10, WNDR4300v2 before 1.0.0.54, and WNDR4500v3 before 1.0.0.54.

Published: Apr 27, 2020
Updated: Apr 13, 2023
CVE: CVE-2018-21152
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.8
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 5.2
AV:A/AC:L/Au:S/C:P/I:P/A:P

CWEs:

CWE-78

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
netgear / d7800_firmware	-	1.0.1.34
netgear / r7500_firmware	-	1.0.3.26
netgear / r7800_firmware	-	1.0.2.42
netgear / r8900_firmware	-	1.0.3.10
netgear / r9000_firmware	-	1.0.3.10
netgear / wndr4300_firmware	-	1.0.0.54
netgear / wndr4500_firmware	-	1.0.0.54

https://kb.netgear.com/000059481/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Gateways-and-Routers-PSV-2017-3152

Vulnerability Database

289,784

CVE-2018-21152