What’s Vulnerable › Vulnerabilities

CVE-2017-18794

• Severity: high (CVSS 8.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-21 · updated 2026-06-17
• Weakness: CWE-74

Description

Certain NETGEAR devices are affected by command injection. This affects R6300v2 before 1.0.4.8_10.0.77, R6400 before 1.0.1.24, R6700 before 1.0.1.26, R7000 before 1.0.9.10, R7100LG before 1.0.0.32, R7900 before 1.0.1.18, R8000 before 1.0.3.54, R8500 before 1.0.2.100, and D6100 before 1.0.0.50_0.0.50.

Affected products

• NETGEAR D6100 Firmware: before 1.0.0.50_0.0.50 — fixed in 1.0.0.50_0.0.50
• NETGEAR R6300 Firmware: before 1.0.4.8_10.0.77 — fixed in 1.0.4.8_10.0.77
• NETGEAR R6400 Firmware: before 1.0.1.24 — fixed in 1.0.1.24
• NETGEAR R6700: before 1.0.1.26 — fixed in 1.0.1.26
• NETGEAR R7000: before 1.0.9.10 — fixed in 1.0.9.10
• NETGEAR R7100Lg Firmware: before 1.0.0.32 — fixed in 1.0.0.32
• NETGEAR R7900 Firmware: before 1.0.1.18 — fixed in 1.0.1.18
• NETGEAR R8000 Firmware: before 1.0.3.54 — fixed in 1.0.3.54
• NETGEAR R8500 Firmware: before 1.0.2.100 — fixed in 1.0.2.100

How to fix

Upgrade to a fixed version: NETGEAR D6100 Firmware 1.0.0.50_0.0.50; NETGEAR R6300 Firmware 1.0.4.8_10.0.77; NETGEAR R6400 Firmware 1.0.1.24; NETGEAR R6700 1.0.1.26; NETGEAR R7000 1.0.9.10; NETGEAR R7100Lg Firmware 1.0.0.32; NETGEAR R7900 Firmware 1.0.1.18; NETGEAR R8000 Firmware 1.0.3.54; NETGEAR R8500 Firmware 1.0.2.100. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000049368/Security-Advisory-for-Command-Injection-Vulnerability-on-D6100-and-Some-Routers-PSV-2017-0321
• https://kb.netgear.com/000049368/Security-Advisory-for-Command-Injection-Vulnerability-on-D6100-and-Some-Routers-PSV-2017-0321

Get alerted when CVE-2017-18794 or the next vulnerability affects your stack