CVE-2018-21097

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-27 · updated 2026-06-17
Weakness: CWE-787

Description

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WAC120 before 2.1.7, WN604 before 3.3.10, WNAP320 before 3.7.11.4, WNAP210v2 before 3.7.11.4, WNDAP350 before 3.7.11.4, WNDAP360 before 3.7.11.4, WNDAP660 before 3.7.11.4, WNDAP620 before 2.1.7, and WND930 before 2.1.5.

Affected products

NETGEAR Wac120 Firmware: before 2.1.7 — fixed in 2.1.7
NETGEAR Wac505 Firmware: before 5.0.5.4 — fixed in 5.0.5.4
NETGEAR Wac510 Firmware: before 5.0.5.4 — fixed in 5.0.5.4
NETGEAR Wn604 Firmware: before 3.3.10 — fixed in 3.3.10
NETGEAR Wnap210 Firmware: before 3.7.11.4 — fixed in 3.7.11.4
NETGEAR Wnap320 Firmware: before 3.7.11.4 — fixed in 3.7.11.4
NETGEAR Wnd930 Firmware: before 2.1.5 — fixed in 2.1.5
NETGEAR Wndap350 Firmware: before 3.7.11.4 — fixed in 3.7.11.4
NETGEAR Wndap360 Firmware: before 3.7.11.4 — fixed in 3.7.11.4
NETGEAR Wndap620 Firmware: before 2.1.7 — fixed in 2.1.7
NETGEAR Wndap660 Firmware: before 3.7.11.4 — fixed in 3.7.11.4

How to fix

Upgrade to a fixed version: NETGEAR Wac120 Firmware 2.1.7; NETGEAR Wac505 Firmware 5.0.5.4; NETGEAR Wac510 Firmware 5.0.5.4; NETGEAR Wn604 Firmware 3.3.10; NETGEAR Wnap210 Firmware 3.7.11.4; NETGEAR Wnap320 Firmware 3.7.11.4; NETGEAR Wnd930 Firmware 2.1.5; NETGEAR Wndap350 Firmware 3.7.11.4; NETGEAR Wndap360 Firmware 3.7.11.4; NETGEAR Wndap620 Firmware 2.1.7; NETGEAR Wndap660 Firmware 3.7.11.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-21097 or the next vulnerability affects your stack