LiveActive security incident?Get immediate response
CVE Record

CVE-2018-21134: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6700 before 1.0.1.48, R7900 before 1.0.2.16, R6900 before 1.0.1.48, R7000P before 1.3.1.44, R6900P before 1.3.1.44, R6250 before 1.0.4.30, R6300v2 before 1.0.4.32, R6400 before 1.0.1.44, R6400v2 before 1.0.2.60, R7000 before 1.0.9.34, R7100LG before 1.0.0.48, R7300 before 1.0.0.68, R8000 before 1.0.4.18, R8000P before 1.4.1.24, R7900P before 1.4.1.24, R8500 before 1.0.2.122, R8300 before 1.0.2.122, WN2500RPv2 before 1.0.1.54, EX3700 before 1.0.0.72, EX3800 before 1.0.0.72, EX6000 before 1.0.0.32, EX6100 before 1.0.2.24, EX6120 before 1.0.0.42, EX6130 before 1.0.0.24, EX6150v1 before 1.0.0.42, EX6200 before 1.0.3.88, EX7000 before 1.0.0.66, D7000v2 before 1.0.0.51, D6220 before 1.0.0.46, D6400 before 1.0.0.82, and D8500 before 1.0.3.42.

MediumCVSS 6.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This CVE affects many older NETGEAR routers, extenders, and modem/router devices running firmware below listed fixed versions. The reported flaw is a stack-based overflow reachable before authentication, which can create serious risk where affected devices remain deployed and reachable.

Executive priority

Prioritize remediation where affected devices sit at network edges, support remote users, or protect sensitive environments. This is not KEV-listed, but stale router firmware can create avoidable compromise paths.

Technical view

CVE-2018-21134 is described as a pre-authentication stack-based buffer overflow across listed NETGEAR models and firmware versions. The CVSS 3.0 score is 6.8, but the vector in the bundle indicates adjacent network access and privileges, which conflicts with the unauthenticated wording.

Likely exposure

Exposure is most likely in homes, small offices, branch networks, and legacy environments still using the listed NETGEAR models with firmware older than the fixed versions in the advisory.

Exploitation context

The bundle does not cite active exploitation, and KEV is false. Treat exploit status as unconfirmed. Business risk comes from unmanaged edge devices that are often long-lived, rarely patched, and sometimes reachable from untrusted networks.

Researcher notes

Evidence is limited to the CVE record and NETGEAR advisory reference. The description says unauthenticated/pre-authentication, while the supplied CVSS vector includes PR:L and AV:A. Validate exposure assumptions against vendor details before rating individual environments.

Mitigation direction

  • Inventory NETGEAR devices against the affected model list.
  • Upgrade affected devices to the listed fixed firmware versions or later.
  • Review NETGEAR advisory guidance for model-specific update paths.
  • Limit device management exposure to trusted networks only.
  • Replace unsupported devices that cannot receive fixed firmware.

Validation and detection

  • Record each device model and current firmware version.
  • Compare firmware versions against the CVE fixed-version list.
  • Confirm whether management interfaces are reachable from untrusted segments.
  • Verify updates completed successfully after firmware maintenance.
  • Document unsupported or unpatched devices as accepted or remediated risk.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-21134 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.8 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:U/UI:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.8CVSS 3.0MediumCVSS:3.0/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:U/UI:N2.14.7Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.8Medium
CVSS 3.0 vector shape for CVE-2018-21134Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AC:L/AV:A/A:L/C:H/I:L/PR:L/S:U/UI:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.