What’s Vulnerable › Vulnerabilities

CVE-2018-11106

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-01 · updated 2026-06-17
• Weakness: CWE-77

Description

NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.

Affected products

• NETGEAR Wc7500 Firmware: before 6.5.3.5 — fixed in 6.5.3.5
• NETGEAR Wc7520 Firmware: before 2.5.0.46 — fixed in 2.5.0.46
• NETGEAR Wc7600V1 Firmware: before 6.5.3.5 — fixed in 6.5.3.5
• NETGEAR Wc7600V2 Firmware: before 6.5.3.5 — fixed in 6.5.3.5
• NETGEAR Wc9500 Firmware: before 6.5.3.5 — fixed in 6.5.3.5

How to fix

Upgrade to a fixed version: NETGEAR Wc7500 Firmware 6.5.3.5; NETGEAR Wc7520 Firmware 2.5.0.46; NETGEAR Wc7600V1 Firmware 6.5.3.5; NETGEAR Wc7600V2 Firmware 6.5.3.5; NETGEAR Wc9500 Firmware 6.5.3.5. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000058243/Security-Advisory-for-Pre-Authentication-Command-Injection-in-request-handler-php-on-Some-Wireless-Controllers-PSV-2018-0051
• https://kb.netgear.com/000058243/Security-Advisory-for-Pre-Authentication-Command-Injection-in-request-handler-php-on-Some-Wireless-Controllers-PSV-2018-0051

Get alerted when CVE-2018-11106 or the next vulnerability affects your stack