CVE-2018-11106 Command injection in WC7500
Pre-authentication command injection in NETGEAR wireless controllers allows remote attackers to execute arbitrary commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11106?
CVE-2018-11106 is a critical command injection vulnerability in NETGEAR WC7500, published on 1 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.
Weakness: CWE-77
Which versions are affected by CVE-2018-11106?
It affects 5 products.
Products include Netgear Wc7500 Firmware, Netgear Wc7520 Firmware, Netgear Wc7600v1 Firmware, Netgear Wc7600v2 Firmware, Netgear Wc9500 Firmware.
How do I fix CVE-2018-11106?
No fix has been published for CVE-2018-11106 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-11106 being exploited?
There is no known exploitation of CVE-2018-11106 in the wild and no public exploit code.
Other vulnerabilities in NETGEAR WC7500
Sources
Also known as GHSA-r3w7-g74j-gc9f.