CVE-2017-18838: netgear m4200_firmware Improper Privilege Management

Vulnerability summary

CVE-2017-18838 is a high (CVSS 7.8) Improper Privilege Management vulnerability in netgear m4200_firmware. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.4% of scored vulnerabilities.

Timeline

1. 20-04-2020
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Certain NETGEAR devices are affected by privilege escalation. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.