High severity · published Apr 22, 2020
CVE-2017-18755
Certain NETGEAR devices are affected by CSRF
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Certain NETGEAR devices are affected by CSRF. This affects R6300v2 before 1.0.4.8, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000P before 1.0.0.86, R6900P before 1.0.0.56, R7300 before 1.0.0.54, R8300 before 1.0.2.106, R8500 before 1.0.2.106, DGN2200v4 before 1.0.0.86, DGND2200Bv4 before 1.0.0.86, R6050 before 1.0.0.86, JR6150 before 1.0.1.10, R6220 before 1.1.0.50, and WNDR3700v5 before V1.1.0.48.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dgn2200 Firmware · Netgear
before 1.0.0.86 · source: NVD
DF
Dgnd2200b Firmware · Netgear
before 1.0.0.86 · source: NVD
JF
Jr6150 Firmware · Netgear
before 1.0.1.10 · source: NVD
RF
R6050 Firmware · Netgear
before 1.0.0.86 · source: NVD
RF
R6220 Firmware · Netgear
before 1.1.0.50 · source: NVD
RF
R6300 Firmware · Netgear
before 1.0.4.8 · source: NVD
RF
R6400 Firmware · Netgear
before 1.0.2.32 · source: NVD
RF
R6700 Firmware · Netgear
before 1.0.1.22 · source: NVD
RF
R6900 Firmware · Netgear
before 1.0.1.22 · source: NVD
RF
R6900p Firmware · Netgear
before 1.0.0.56 · source: NVD
RF
R7000p Firmware · Netgear
before 1.0.0.86 · source: NVD
RF
R7300 Firmware · Netgear
before 1.0.0.54 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-18755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-18755
Vendor Advisory
https://kb.netgear.com/000051493/Security-Advisory-for-Cross-Site-Request-Forgery-on-Routers-and-Modem-Routers-PSV-2017-0333
More from Dgn2200 Firmware
9.8
CVE-2017-6077
NETGEAR DGN2200 Remote Code Execution Vulnerability
9.8
CVE-2021-38516
Certain NETGEAR devices are affected by lack of access control at the function level
9.8
CVE-2019-17373
Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL
9.8
CVE-2016-5649
A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a…
8.8
CVE-2025-12944
Improper input validation in NETGEAR DGN2200v4 (N300 Wireless ADSL2+ Modem Router) allows attackers with direct network access to the device to potentially execute code on the…