CVE-2017-18844 Information disclosure in n/a

High 8.4 Published 20 Apr 2020 Updated 5 Aug 2024

Attackers can disclose administrative credentials on certain NETGEAR routers, potentially leading to full device compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-18844?

CVE-2017-18844 is a high-severity vulnerability in Netgear D7000 Firmware, published on 20 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, and D7000 before 1.0.1.50.

Weakness: CWE-522

Which versions are affected by CVE-2017-18844?

It affects 3 products.

Products include Netgear D7000 Firmware, Netgear R6700 Firmware, Netgear R6800 Firmware.

How do I fix CVE-2017-18844?

No fix has been published for CVE-2017-18844 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-18844 being exploited?

There is no known exploitation of CVE-2017-18844 in the wild and no public exploit code.

All Netgear D7000 Firmware vulnerabilities

Sources

Also known as GHSA-fhv4-qrh6-mmh4.