What is CVE-2018-21162?

CVE-2018-21162 is a critical-severity vulnerability in Netgear D6400, classified under OS Command Injection. CVSS score: 9.8/10. Published 2020-04-23.

How severe is CVE-2018-21162?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Netgear D6400

CVE-2018-21162

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6400 before 1.0.0.78, EX6200 before 1.0.3.86, EX7000 before 1.0.0.64, R6250 before 1.0.4.8, R6300v2 before 1.0.4.6, R6400 before 1.0.1…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.034 (87.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Netgear D6400
Netgear D6400_firmware
Netgear Ex6200
Netgear Ex6200_firmware
Netgear Ex7000
Netgear Ex7000_firmware
Netgear R6250
Netgear R6250_firmware
Netgear R6300 — versions v2
Netgear R6300_firmware

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-21162?: CVE-2018-21162 is a critical-severity vulnerability in Netgear D6400, classified under OS Command Injection. CVSS score: 9.8/10. Published 2020-04-23.
How severe is CVE-2018-21162?: Critical severity. CVSS v3 base score is 9.8 out of 10.