Security readout for executives and security teams
Plain-English summary
CVE-2017-18828 is a stored cross-site scripting issue in several NETGEAR fully managed switches. A successful attack could let malicious content persist in the switch interface and run when an administrator views it. The CVSS score is medium, but affected switches manage network infrastructure, so remediation should be tracked.
Executive priority
Treat as a planned infrastructure remediation item, not an emergency based on current evidence. Prioritize exposed or production switching environments because compromise of management interfaces can affect trust in network administration.
Technical view
The CVE describes stored XSS affecting NETGEAR M4300 and M4200 switch models before firmware 12.0.2.15. The CVSS v3.0 vector indicates low complexity, high privileges required, user interaction required, changed scope, and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is likely limited to organizations running listed NETGEAR M4300 or M4200 switches below 12.0.2.15. Risk increases where administrative web interfaces are reachable by many users or shared admin workstations are used.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The vector suggests exploitation requires privileged access and an administrator or user interaction, reducing broad internet-scale risk but not eliminating insider or compromised-admin scenarios.
Researcher notes
Structured affected CPE data is incomplete in the bundle, but the description names affected models and fixed-before version. No CWE is listed. Avoid assuming exploit availability; validate by model and firmware against NETGEAR’s advisory.
Mitigation direction
- Upgrade affected NETGEAR switches to firmware 12.0.2.15 or later where applicable.
- Confirm model-specific firmware and instructions in the NETGEAR advisory.
- Restrict management interface access to trusted administrative networks and accounts.
- Prioritize devices used in production, core switching, or shared administrative environments.
Validation and detection
- Inventory NETGEAR M4300 and M4200 switches and record firmware versions.
- Confirm whether any listed model is running firmware earlier than 12.0.2.15.
- Review administrative access paths to each switch management interface.
- Check change records for firmware upgrade completion and operational impact.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-18828 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.2 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:L/A:L/C:L/I:L/PR:H/S:C/UI:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:L/A:L/C:L/I:L/PR:H/S:C/UI:R1.13.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.2MediumVector: CVSS:3.0/AC:L/AV:L/A:L/C:L/I:L/PR:H/S:C/UI:R
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000049033/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Fully-Managed-Switches-PSV-2017-1938CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.