Security readout for executives and security teams
Plain-English summary
This issue affects NETGEAR ReadyNAS OS 6 devices running versions before 6.8.0. A stored cross-site scripting flaw could let a privileged attacker place malicious script that later runs in another user's browser. The business risk is moderate because exploitation requires high privileges and user interaction, but NAS administration interfaces can expose sensitive operational data.
Executive priority
Prioritize remediation for internet-reachable or broadly accessible NAS management interfaces. Overall urgency is moderate: the flaw can affect admin browser sessions, but available evidence shows privilege and interaction requirements and no confirmed active exploitation in the supplied sources.
Technical view
CVE-2017-18807 is stored XSS in NETGEAR ReadyNAS OS 6 before 6.8.0. The CVSS 3.0 vector is 5.2 medium: local attack vector, low complexity, high privileges required, user interaction required, changed scope, and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is mainly organizations still operating legacy NETGEAR ReadyNAS OS 6 appliances below version 6.8.0. The bundle does not provide CPEs, affected model names, or internet exposure data, so validation must come from asset inventory and device firmware checks.
Exploitation context
The source bundle does not show CISA KEV listing or other evidence of active exploitation. The CVSS vector indicates exploitation is not remote unauthenticated: it requires local access, high privileges, and a user action. Treat this as a management-plane risk, not a mass exploitation signal from the provided evidence.
Researcher notes
Evidence is sparse. The CVE and advisory identify stored XSS in ReadyNAS OS 6 before 6.8.0, but the bundle lacks model lists, parameters, proof-of-concept details, or explicit exploit telemetry. Avoid assuming broader NETGEAR product impact without vendor confirmation.
Mitigation direction
- Identify ReadyNAS OS 6 devices and their exact firmware versions.
- Move affected devices off versions earlier than 6.8.0 where supported.
- Review the NETGEAR advisory for vendor-approved update or mitigation guidance.
- Restrict administrative interface access to trusted management networks.
- Limit high-privilege accounts and review administrator access.
Validation and detection
- Inventory NETGEAR ReadyNAS OS 6 assets across offices and datacenters.
- Confirm whether any device runs ReadyNAS OS earlier than 6.8.0.
- Check whether admin interfaces are reachable beyond trusted networks.
- Review administrator accounts for unnecessary or stale privileged access.
- Track remediation evidence with firmware screenshots or asset records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-18807 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.2 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:L/A:L/C:L/I:L/PR:H/S:C/UI:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:L/A:L/C:L/I:L/PR:H/S:C/UI:R1.13.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.2MediumVector: CVSS:3.0/AC:L/AV:L/A:L/C:L/I:L/PR:H/S:C/UI:R
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000049058/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-2001CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.