CVE-2018-11106: netgear wc7500_firmware Command Injection
Vulnerability summary
CVE-2018-11106 is a high (CVSS 10.0) Command Injection vulnerability in netgear wc7500_firmware. EPSS estimates a 2.60% chance of exploitation in the next 30 days, higher than 85.1% of scored vulnerabilities.
Timeline
- 01-04-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.60%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.60% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Netgear5 products
- wc7500_firmwarefirmware versions prior to 6.5.3.5 | < 6.5.3.5
- wc7520_firmwarefirmware versions prior to 2.5.0.46 | < 2.5.0.46
- wc7600v1_firmwarefirmware versions prior to 6.5.3.5 | < 6.5.3.5
- wc7600v2_firmwarefirmware versions prior to 6.5.3.5 | < 6.5.3.5
- wc9500_firmwarefirmware versions prior to 6.5.3.5 | < 6.5.3.5
1 vendor · 5 products
References
1 links- kb.netgear.com/000058243/…X Refsource CONFIRM