Security readout for executives and security teams
Plain-English summary
CVE-2018-21204 is a high-severity pre-authentication stack overflow affecting several older NETGEAR routers and gateways. An attacker does not need credentials, and successful exploitation could compromise confidentiality, integrity, and availability. The CVSS vector indicates adjacent-network access, so exposure is most urgent on untrusted LAN, Wi-Fi, guest, or shared-network segments.
Executive priority
Treat this as a near-term network hygiene and legacy-device risk. Prioritize exposed branch, small-office, guest-network, and unmanaged router deployments first because the issue requires no login and can affect full device compromise outcomes.
Technical view
The CVE describes a stack-based buffer overflow reachable before authentication on specific NETGEAR models. Affected firmware is older than listed fixed versions for D7800, R6100, R7500, R7500v2, R7800, R9000, WNDR3700v4, WNDR4300, WNDR4300v2, and WNDR4500v3. CVSS 3.0 is 8.8 with low complexity, no privileges, and no user interaction.
Likely exposure
Organizations are exposed if they still operate the named NETGEAR devices below the listed firmware versions, especially on reachable internal, Wi-Fi, guest, lab, branch, or remote-office networks.
Exploitation context
The bundle does not cite active exploitation, and the CVE is not marked in KEV. The vulnerability is still serious because it is pre-authentication, low-complexity, and impacts confidentiality, integrity, and availability when reachable from an adjacent network.
Researcher notes
The source bundle does not include endpoint-level root cause, proof-of-concept details, or evidence of exploitation in the wild. Analysis should stay focused on model and firmware validation, reachability, and vendor-advisory remediation rather than attempting exploit reproduction.
Mitigation direction
- Upgrade affected NETGEAR devices to the listed fixed firmware versions or later.
- Check the NETGEAR advisory for current vendor guidance before changing production devices.
- Retire unsupported devices if current fixed firmware is unavailable.
- Restrict management and device access from guest or untrusted network segments.
- Inventory branch, lab, and remote-office routers for the affected model list.
Validation and detection
- Identify NETGEAR device model and hardware revision.
- Compare installed firmware against the affected version thresholds in the CVE description.
- Confirm device reachability from guest, Wi-Fi, and shared LAN segments.
- Document whether the device is patched, isolated, retired, or still exposed.
- Monitor vendor guidance for any updated remediation notes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-21204 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:U/UI:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.netgear.com/000055145/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2569CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.