← Vulnerability feed

Vulnerability record · CVE-2017-18858 · published 28 April 2020

CVE-2017-18858: Netgear m4200-10mg-poe\+ firmware os command injection vulnerability

Netgear · M4200 10mg Poe\+ Firmware

Certain NETGEAR devices are affected by command execution. This affects M4200-10MG-POE+ 12.0.2.11 and earlier, M4300-28G 12.0.2.11 and earlier, M4300-52G 12.0.2.11 and earlier, M4300-28G-POE+ 12.0.2.11 and earlier, M4300-52G-POE+ 12.0.2.11 and earlier, M4300-8X8F 12.0.2.11 and earlier, M4300-12X12F 12.0.2.11 and earlier, M4300-24X24F 12.0.2.11 and earlier, M4300-24X 12.0.2.11 and earlier, and M4300-48X 12.0.2.11 and earlier.

9.8 CVSS 3.1 Critical EPSS 3.1% · top 12.5% CWE-78 · OS command injection
9.8CVSS 3.1 base score, v2 10.0
3.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
10Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Certain NETGEAR devices are affected by command execution. This affects M4200-10MG-POE+ 12.0.2.11 and earlier, M4300-28G 12.0.2.11 and earlier, M4300-52G 12.0.2.11 and earlier, M4300-28G-POE+ 12.0.2.11 and earlier, M4300-52G-POE+ 12.0.2.11 and earlier, M4300-8X8F 12.0.2.11 and earlier, M4300-12X12F 12.0.2.11 and earlier, M4300-24X24F 12.0.2.11 and earlier, M4300-24X 12.0.2.11 and earlier, and M4300-48X 12.0.2.11 and earlier.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

10 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.netgear.com/000038655/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-M4200-and-M4300-PSV-2017 Vendor Advisory
https://kb.netgear.com/000038655/Security-Advisory-for-Unauthenticated-Remote-Code-Execution-on-M4200-and-M4300-PSV-2017 Vendor Advisory

Track CVE-2017-18858 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2017-18837Netgear m4300-28g firmware improper privilege management vulnerabilityCertain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G…EPSS 0.31%7.8CVE-2017-18830Netgear m4300-28g firmware improper privilege management vulnerabilityCertain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G…EPSS 0.31%7.8CVE-2017-18826Netgear m4300-28g firmware improper privilege management vulnerabilityCertain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G…EPSS 0.31%7.8CVE-2017-18829Netgear m4300-28g firmware improper privilege management vulnerabilityCertain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G…EPSS 0.27%7.8CVE-2017-18822Netgear m4300-28g firmware improper privilege management vulnerabilityCertain NETGEAR devices are affected by vertical privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G…EPSS 0.37%7.8CVE-2017-18838Netgear m4300-28g firmware improper privilege management vulnerabilityCertain NETGEAR devices are affected by privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ bef…EPSS 0.27%6.2CVE-2017-18836Netgear m4300-28g firmware vulnerabilityCertain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before…EPSS 0.37%6.2CVE-2017-18840Netgear m4300-28g firmware improper input validation vulnerabilityCertain NETGEAR devices are affected by denial of service. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before…EPSS 0.30%

Source: NIST National Vulnerability Database (record CVE-2017-18858), CISA KEV, FIRST EPSS (scores of 2026-10-05). This page is refreshed as NVD updates the record.