{"cvss":8.4,"datePublished":"2023-11-13T00:00:00Z","dateUpdated":"2023-11-13T00:00:00Z","description":"In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_dir, leading to upgrade_handle.php?cmd=writeuploaddir remote command execution.","dueDate":"","id":"CVE-2017-18378","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"readynas_surveillance_firmware","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"NETGEAR readynas_surveillance_firmware Improper Neutralization of Special Elements used in a Command","vendor":"NETGEAR"}