vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2018-11106

CRITICAL
9.8
CVSS Score
Published: April 1, 2020 at 04:31 PM UTC
Updated: June 17, 2026 at 01:35 AM UTC
10 products affected across 1 vendorWC7500 FirmwareWC9500 FirmwareWC7600V2 Firmware

Using WC7500 by NETGEAR?

Get instant alerts when new vulnerabilities affect WC7500 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
CRITICAL9.8
Exploit prediction
EPSS 3%

Description

NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, running firmware versions prior to 6.5.3.5; WC7520, running firmware versions prior to 2.5.0.46; WC7600v1, running firmware versions prior to 6.5.3.5; WC7600v2, running firmware versions prior to 6.5.3.5; and WC9500, running firmware versions prior to 6.5.3.5.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

WC7500 Firmware· NETGEAR
95%
v < 6.5.3.5
Affected range stops below 6.5.3.5, so it looks safe — our inference, not a vendor statement
netgear-wc7500 (same device)
WC7520 Firmware· NETGEAR
95%
v < 2.5.0.46
Affected range stops below 2.5.0.46, so it looks safe — our inference, not a vendor statement
netgear-wc7520 (same device)
WC7600V1 Firmware· NETGEAR
95%
v < 6.5.3.5
Affected range stops below 6.5.3.5, so it looks safe — our inference, not a vendor statement
netgear-wc7600v1 (same device)
WC7600V2 Firmware· NETGEAR
95%
v < 6.5.3.5
Affected range stops below 6.5.3.5, so it looks safe — our inference, not a vendor statement
netgear-wc7600v2 (same device)
WC9500 Firmware· NETGEAR
95%
v < 6.5.3.5
Affected range stops below 6.5.3.5, so it looks safe — our inference, not a vendor statement
netgear-wc9500 (same device)
Wc7500· NETGEARdevice
80%
All versions
Wc7520· NETGEARdevice
80%
All versions
Wc7600V1· NETGEARdevice
80%
All versions
Wc7600V2· NETGEARdevice
80%
All versions
Wc9500· NETGEARdevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_CONFIRM
Source: a2826606-91e7-4eb6-899e-8484bd4575d5
https://kb.netgear.com/000058243/Security-Advisory-for-Pre-Authentication-Command-Injection-in-request-handler-php-on-Some-Wireless-Controllers-PSV-2018-0051

CVSS

9.8CRITICAL[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-77

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card