7.1

CVE-2017-18863

Certain NETGEAR devices are affected by command execution via a PHP form. This affects WN604 3.3.3 and earlier, WNAP210v2 3.5.20.0 and earlier, WNAP320 3.5.20.0 and earlier, WNDAP350 3.5.20.0 and earlier, WNDAP360 3.5.20.0 and earlier, WNDAP620 2.0.11 and earlier, WNDAP660 3.5.20.0 and earlier, WND930 2.0.11 and earlier, and WAC120 2.0.7 and earlier.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
NetgearWn604 Firmware Version < 3.3.3
   NetgearWn604 Version-
NetgearWnap210 Firmware Version < 3.5.20.0
   NetgearWnap210 Versionv2
NetgearWnap320 Firmware Version < 3.5.20.0
   NetgearWnap320 Version-
NetgearWndap350 Firmware Version < 3.5.20.0
   NetgearWndap350 Version-
NetgearWndap360 Firmware Version < 3.5.20.0
   NetgearWndap360 Version-
NetgearWndap620 Firmware Version < 2.0.11
   NetgearWndap620 Version-
NetgearWndap660 Firmware Version < 3.5.20.0
   NetgearWndap660 Version-
NetgearWnd930 Firmware Version < 2.0.11
   NetgearWnd930 Version-
NetgearWac120 Firmware Version < 2.0.7
   NetgearWac120 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.366
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 3.6 3.9 4.9
AV:L/AC:L/Au:N/C:P/I:P/A:N
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.