CVE-2017-6862

A buffer overflow (CWE-119) affects multiple NETGEAR networking devices and can be exploited remotely, allowing an attacker to bypass authentication on the device and potentially execute arbitrary code. The flaw is triggered when the affected device processes crafted network input, overflowing a memory buffer such that authentication checks can be bypassed or attacker-controlled code runs on the device. A successful attacker gains unauthorized access to the device's administrative functions or code execution on the device itself, providing a foothold for traffic interception, botnet enrollment, or pivoting into the network behind it. Any home or small-office operator running an affected NETGEAR model on unpatched firmware is affected; the specific model and firmware ranges are enumerated in NETGEAR's advisory rather than in this data. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-06-08, EPSS puts its 30-day exploitation probability at 42.7% (99th percentile), while no public PoC is cataloged and ransomware use is unknown.

What to do: Update affected NETGEAR devices to the fixed firmware listed in NETGEAR's security advisory for your exact model (check the model on the device label and the NETGEAR support page), since firmware is released per model. Until patched, disable or restrict remote/WAN administration so the web management interface is not exposed to the internet, and restrict admin access to trusted hosts. Because the flaw is on CISA's KEV catalog, federal agencies must patch by the required deadline, and defenders should prioritize any internet-exposed units.