CVE-2017-18378

moderate-risk
Published 2019-06-11

In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_dir, leading to upgrade_handle.php?cmd=writeuploaddir remote command execution.

Do I need to act?

!
15.5% chance of exploitation in next 30 days
EPSS score — higher than 84% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.4/10 High
LOCAL / LOW complexity

Affected Products (2)

Affected Vendors

Netgear

References (4)

Vendor Advisory https://kb.netgear.com/000049072/Security-Advisory-for-Command-Injection-in-Read...
Exploit https://www.exploit-db.com/exploits/42956
Vendor Advisory https://kb.netgear.com/000049072/Security-Advisory-for-Command-Injection-in-Read...
Exploit https://www.exploit-db.com/exploits/42956
46
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 13/34 · Low
Exposure 7/34 · Low