CVE-2017-18799

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-21 · updated 2026-06-17
Weakness: CWE-20

Description

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6200v2 before 1.0.3.14, R6250 before 1.0.4.8, R6300v2 before 1.0.4.8, R6700 before 1.1.1.20, R7000 before 1.0.7.10, R7000P/R6900P before 1.0.0.56, R7100LG before 1.0.0.30, R7900 before 1.0.1.14, R8000 before 1.0.3.22, R8500 before 1.0.2.74, and D8500 before 1.0.3.28.

Affected products

NETGEAR D8500 Firmware: before 1.0.3.28 — fixed in 1.0.3.28
NETGEAR R6200 Firmware: before 1.0.3.14 — fixed in 1.0.3.14
NETGEAR R6250 Firmware: before 1.0.4.8 — fixed in 1.0.4.8
NETGEAR R6300 Firmware: before 1.0.4.8 — fixed in 1.0.4.8
NETGEAR R6700: before 1.1.1.20 — fixed in 1.1.1.20
NETGEAR R6900P Firmware: before 1.0.0.56 — fixed in 1.0.0.56
NETGEAR R7000: before 1.0.7.10 — fixed in 1.0.7.10
NETGEAR R7000P: before 1.0.0.56 — fixed in 1.0.0.56
NETGEAR R7100Lg Firmware: before 1.0.0.30 — fixed in 1.0.0.30
NETGEAR R7900 Firmware: before 1.0.1.14 — fixed in 1.0.1.14
NETGEAR R8000 Firmware: before 1.0.3.22 — fixed in 1.0.3.22
NETGEAR R8500 Firmware: before 1.0.2.74 — fixed in 1.0.2.74

How to fix

Upgrade to a fixed version: NETGEAR D8500 Firmware 1.0.3.28; NETGEAR R6200 Firmware 1.0.3.14; NETGEAR R6250 Firmware 1.0.4.8; NETGEAR R6300 Firmware 1.0.4.8; NETGEAR R6700 1.1.1.20; NETGEAR R6900P Firmware 1.0.0.56; NETGEAR R7000 1.0.7.10; NETGEAR R7000P 1.0.0.56; NETGEAR R7100Lg Firmware 1.0.0.30; NETGEAR R7900 Firmware 1.0.1.14; NETGEAR R8000 Firmware 1.0.3.22; NETGEAR R8500 Firmware 1.0.2.74. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-18799 or the next vulnerability affects your stack