CVE-2017-18378: Command Injection
In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $GET['uploaddir'] is not escaped and is passed to system() through $tmpuploaddir, leading to upgradehandle.php?cmd=writeuploaddir remote command execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-18378?
CVE-2017-18378 is classified as a critical vulnerability due to its potential for remote command execution.
How do I fix CVE-2017-18378?
To fix CVE-2017-18378, upgrade to NETGEAR ReadyNAS Surveillance versions 1.4.3-17 for x86 or 1.1.4-7 for ARM, which contain the necessary security patches.
What systems are affected by CVE-2017-18378?
CVE-2017-18378 affects NETGEAR ReadyNAS Surveillance firmware versions prior to 1.4.3-17 for x86 and prior to 1.1.4-7 for ARM.
What type of vulnerability is CVE-2017-18378?
CVE-2017-18378 is a command injection vulnerability that allows an attacker to execute arbitrary commands on the affected system.
How can CVE-2017-18378 be exploited?
CVE-2017-18378 can be exploited by manipulating the $_GET['uploaddir'] parameter to execute system commands via the upgrade_handle.php script.