Security readout for executives and security teams
Plain-English summary
This CVE covers a security misconfiguration in many NETGEAR routers and gateways. The public record rates it high because successful local exploitation could affect confidentiality, integrity, and availability. The sources identify affected models and fixed firmware thresholds but do not describe the exact misconfiguration mechanism.
Executive priority
Prioritize remediation where affected NETGEAR devices protect business networks, remote sites, or sensitive segments. The rating is high, but the available evidence supports local-risk handling rather than emergency internet-wide exploitation response.
Technical view
CVE-2017-18778 affects listed NETGEAR devices running firmware before specified versions. CVSS 3.0 is 8.4 with local attack vector, low complexity, no privileges, no user interaction, and high CIA impact. No CWE is provided in the source bundle.
Likely exposure
Exposure is most likely in environments still using the listed NETGEAR router or gateway models below the fixed firmware versions. The CVSS vector is local, so risk depends on local access to the device or its operating environment rather than confirmed internet-scale reachability.
Exploitation context
The provided sources do not report active exploitation, and the CVE is not marked as CISA KEV. Treat exploit status as unconfirmed. The public data does not provide enough detail to assess exploit maturity or prerequisites beyond the CVSS local vector.
Researcher notes
The source bundle names many models and fixed firmware thresholds but lacks root-cause detail, CWE mapping, or exploit narrative. Validation should focus on exact model and firmware matching, then vendor advisory confirmation.
Mitigation direction
- Inventory NETGEAR models listed in the CVE description.
- Upgrade affected devices to at least the fixed firmware versions listed.
- Check NETGEAR advisory for current firmware and product-specific guidance.
- Replace or isolate devices that cannot receive fixed firmware.
- Limit local access to device management and trusted networks.
Validation and detection
- Compare each device model and firmware version against the CVE affected list.
- Confirm firmware is equal to or newer than the listed fixed version.
- Review NETGEAR advisory for model-specific update instructions.
- Document unsupported or unpatchable devices for replacement planning.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-18778 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.4 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N2.55.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.4HighVector: CVSS:3.0/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000049543/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2017-2957CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.