Security readout for executives and security teams
Plain-English summary
This CVE covers a security misconfiguration in several NETGEAR wireless access points. An unauthenticated network attacker may affect confidentiality, integrity, and availability at a limited level. Organizations using older firmware on the named access points should treat this as a high-priority network-edge remediation item.
Executive priority
Prioritize remediation during the next network maintenance window, sooner for exposed or high-value sites. This is high severity, remotely reachable, and affects infrastructure devices, but the provided evidence does not show active exploitation.
Technical view
CVE-2018-21094 affects specified NETGEAR access point models before fixed firmware versions. CVSS 3.0 is 7.3 high, with network attack vector, low complexity, no privileges, and no user interaction. The public bundle does not identify a CWE or provide technical root-cause detail beyond security misconfiguration.
Likely exposure
Exposure is limited to organizations running the listed NETGEAR wireless access point models below the fixed versions. Wireless infrastructure, branch offices, and small-business networks are plausible locations. The bundle does not prove exposure for other NETGEAR products.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. The CVSS vector indicates remote network attack potential without authentication or user interaction, but the provided sources do not include exploit details.
Researcher notes
The public bundle is sparse: it provides affected models, fixed-version thresholds, CVSS, and NETGEAR advisory reference, but no CWE or detailed misconfiguration mechanics. Avoid extrapolating affected products or exploitability beyond the listed models and versions.
Mitigation direction
- Inventory the listed NETGEAR wireless access point models across all sites.
- Upgrade affected devices to NETGEAR fixed firmware versions or later.
- Prioritize devices on untrusted, guest, or externally reachable network paths.
- Follow the NETGEAR advisory for model-specific firmware guidance.
- Retire unsupported devices if fixed firmware cannot be applied.
Validation and detection
- Compare each device model and firmware version against the CVE affected list.
- Confirm WAC120 and WNDAP620 are on 2.1.7 or later.
- Confirm WAC505 and WAC510 are on 5.0.5.4 or later.
- Confirm WNAP/WNDAP listed devices are on 3.7.11.4 or later where applicable.
- Confirm WND930 is on 2.1.5 or later and WN604 is on 3.3.10 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-21094 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:N/A:L/C:L/I:L/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:N/A:L/C:L/I:L/PR:N/S:U/UI:N3.93.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.3HighVector: CVSS:3.0/AC:L/AV:N/A:L/C:L/I:L/PR:N/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000060460/Security-Advisory-for-a-Security-Misconfiguration-on-Some-Wireless-Access-Points-PSV-2018-0350CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.