Security readout for executives and security teams
Plain-English summary
This CVE covers a security misconfiguration in several NETGEAR Wi-Fi extenders. An unauthenticated attacker on an adjacent network could potentially cause severe confidentiality, integrity, and availability impact. There is no source evidence here of known active exploitation.
Executive priority
Prioritize remediation where these extenders support business networks, remote offices, or shared environments. Treat this as high risk for affected assets, but not as a KEV-driven emergency based on the provided sources.
Technical view
CVE-2017-18747 affects specific NETGEAR extender models running firmware earlier than listed fixed thresholds. The CVSS 3.0 vector is 8.8 high: adjacent network access, low complexity, no privileges, no user interaction, with high CIA impact. The provided sources do not describe the exact misconfiguration or exploit mechanics.
Likely exposure
Exposure is most likely where affected NETGEAR extender models remain deployed on vulnerable firmware. The CVSS adjacent-network vector suggests risk from attackers with local Wi-Fi or network proximity, not necessarily internet-wide exposure.
Exploitation context
The source bundle marks CISA KEV as false and provides no cited evidence of active exploitation. The available public details are limited to affected models, firmware thresholds, and severity characteristics.
Researcher notes
Public evidence is sparse: no CWE, no affected CPEs, and no technical root-cause detail beyond security misconfiguration. Validation should focus on model and firmware matching, while avoiding assumptions about exploitability beyond the CVSS vector.
Mitigation direction
- Inventory the listed NETGEAR extender models and record firmware versions.
- Upgrade affected devices to firmware at or newer than the listed fixed versions.
- Remove or replace unsupported devices that cannot be updated.
- Limit extender use to trusted environments pending remediation.
- Monitor NETGEAR advisory guidance for device-specific instructions.
Validation and detection
- Compare each device firmware version against the affected thresholds in the CVE description.
- Confirm no listed model remains below its fixed firmware version.
- Verify asset inventories include consumer-grade extenders used in offices or remote sites.
- Document exceptions and compensating controls for devices awaiting replacement.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-18747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000051507/Security-Advisory-for-Security-Misconfiguration-on-Some-Extenders-PSV-2016-0115CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.