What’s Vulnerable › Vulnerabilities

CVE-2017-18754

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-22 · updated 2026-06-17
• Weakness: CWE-74

Description

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WNDR3700v4 before 1.0.2.88, WNDR4300v1 before 1.0.2.90, and WNR2000v5 before 1.0.0.58.

Affected products

• NETGEAR Wndr3700 Firmware: before 1.0.2.88 — fixed in 1.0.2.88
• NETGEAR Wndr4300 Firmware: before 1.0.2.90 — fixed in 1.0.2.90
• NETGEAR Wnr2000 Firmware: before 1.0.0.58 — fixed in 1.0.0.58

How to fix

Upgrade to a fixed version: NETGEAR Wndr3700 Firmware 1.0.2.88; NETGEAR Wndr4300 Firmware 1.0.2.90; NETGEAR Wnr2000 Firmware 1.0.0.58. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000051494/Security-Advisory-for-Post-Authentication-Command-Injection-on-Routers-PSV-2017-0329
• https://kb.netgear.com/000051494/Security-Advisory-for-Post-Authentication-Command-Injection-on-Routers-PSV-2017-0329

Get alerted when CVE-2017-18754 or the next vulnerability affects your stack