NETGEAR WNDAP360 Firmware vulnerabilities

10 CVEs affecting NETGEAR WNDAP360 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-18863, published 2020-04-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-1555: NETGEAR Multiple WAP Devices Command Injection Vulnerability, published 2017-04-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 98.3% chance of exploitation in the next 30 days. (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and…
CVE-2016-1556, published 2017-04-21. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allows remote attackers to read the wireless WPS PIN or…
CVE-2016-1557, published 2017-04-21. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP.
CVE-2018-21097, published 2020-04-27. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WAC120 before 2.1.7, WN604 before…
CVE-2018-21094, published 2020-04-27. High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4,…
CVE-2017-18805, published 2020-04-21. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection. This affects WAC510 before 1.3.0.10, WAC120 before 2.1.4, WNDAP620 before 2.1.3, WND930 before 2.1.2, WN604 before 3.3.7, WNDAP660 before…
CVE-2017-18806, published 2020-04-21. Medium severity, CVSS 6.7. EPSS: 0.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection. This affects WAC510 before 1.3.0.10, WAC120 before 2.1.4, WNDAP620 before 2.1.3, WND930 before 2.1.2, WN604 before 3.3.7, WNDAP660 before…
CVE-2017-18863, published 2020-04-28. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command execution via a PHP form. This affects WN604 3.3.3 and earlier, WNAP210v2 3.5.20.0 and earlier, WNAP320 3.5.20.0 and earlier, WNDAP350 3.5.20.0 and…
CVE-2018-21120, published 2020-04-22. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4, WNAP210v2 before 3.7.11.4, WNDAP350 before…
CVE-2018-21096, published 2020-04-27. High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by CSRF. This affects WAC120 before 2.1.7, WAC505 before 5.0.5.4, WAC510 before 5.0.5.4, WNAP320 before 3.7.11.4, WNAP210v2 before 3.7.11.4, WNDAP350 before…