Security readout for executives and security teams
Plain-English summary
CVE-2018-21194 is a post-authentication stack overflow in certain NETGEAR routers and gateways. An attacker already authenticated to device administration, from an adjacent network per CVSS, could cause serious confidentiality, integrity, and availability impact. Business risk is mainly unmanaged legacy network devices running firmware older than NETGEAR's fixed releases.
Executive priority
Treat this as a moderate-priority legacy network hygiene issue. It is not cited as actively exploited, but successful abuse could fully impact a device once an attacker has privileged administrative access.
Technical view
The CVE describes a stack-based buffer overflow reachable by an authenticated user on specific NETGEAR D-, R-, WNDR-, and WNR-series firmware. CVSS v3.0 is 6.8: adjacent attack vector, low complexity, high privileges, no user interaction, and high C/I/A impact. The bundle lists fixed version thresholds but no endpoint, CWE, or exploit details.
Likely exposure
Organizations are exposed if they still operate listed NETGEAR models below the fixed firmware versions. This is most likely in small offices, remote sites, labs, or legacy network segments where consumer-grade routers remain unmanaged.
Exploitation context
The provided sources do not state active exploitation, and KEV is false. The vulnerability requires authenticated access and adjacent-network reachability according to the CVSS vector, reducing broad internet-drive-by risk but increasing concern where admin credentials or local network access are weak.
Researcher notes
Evidence is limited to the CVE record and NETGEAR advisory reference. The bundle does not provide a vulnerable function, endpoint, proof of concept, CWE, workaround, or exploitation telemetry. Avoid assuming affected products beyond the listed models and versions.
Mitigation direction
- Upgrade affected NETGEAR devices to the fixed firmware versions or later.
- Inventory listed NETGEAR models across branch, lab, and remote-office networks.
- Restrict administrative access to trusted management networks and named administrators.
- Check NETGEAR's advisory for model-specific firmware and operational guidance.
- Replace unsupported or unmanageable legacy routers where firmware cannot be verified.
Validation and detection
- Identify device model and current firmware version from management records or the admin interface.
- Compare firmware against NETGEAR's fixed version thresholds for that exact model.
- Confirm administrative interfaces are not reachable from untrusted adjacent networks.
- Review admin account hygiene, shared credentials, and unnecessary privileged users.
- After upgrade, recheck firmware version and document remediation evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-21194 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N0.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
6.8MediumVector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:H/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000055163/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2601CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.