CVE-2021-45077: Cleartext Storage of Sensitive Information

Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device...

Netgear Nighthawk R6700 信任管理问题漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the fact that the product does not effectively encrypt configuration files. An attacker could modify the backup configuration by extracting the...

CVE-2021-23147: Improper Authentication

Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication...

Netgear Nighthawk R6700 加密问题漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the product's failure to encrypt account information. An attacker could obtain plaintext account information in the Zhu configuration file throug...

CVE-2021-20174: Cleartext Transmission of Sensitive Information

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be transmitted in...

PT-2021-15393

Name of the Vulnerable Software and Affected Versions Netgear Nighthawk R6700 version 1.0.4.120 Description The issue concerns insufficient protections for the UART console, allowing a malicious actor with physical access to the device to connect to the UART port via a serial connection and execu...

PT-2021-13827

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the lack of secure communication methods to the SOAP interface. By default, all communication to and from the device's SOAP Interface on port 5000 is sent via HTTP,...

PT-2021-13826

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the lack of secure communication methods to the web interface. By default, all communication to and from the device's web interface is sent via HTTP, causing potentiall...

PT-2021-24196

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the storage of sensitive information in plaintext. Specifically, all usernames and passwords for the device's associated services are stored in plaintext on the device...

PT-2021-24295

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns a hardcoded credential in the Netgear Nighthawk R6700. Although configuration backups are encrypted or obfuscated, suggesting they are not intended for user manipulatio...

PT-2021-13825

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns a command injection vulnerability in the update functionality of the device. This vulnerability can be triggered by initiating a system update check via the SOAP...

CVE-2021-45732: Use of Hard-coded Credentials

Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools,...

CVE-2021-27253

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...

CVE-2021-27253

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...

CVE-2021-27253: Heap-based Buffer Overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...

CVE-2021-27251: Cleartext Transmission of Sensitive Information

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Authentication is not required to exploit this vulnerability The specific flaw exists within handling of firmware updates. The issue results from a fallback to a...

(Pwn2Own) NETGEAR Nighthawk R7800 ready-genie-cloud Insecure Download of Critical Component Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Authentication is not required to exploit this vulnerability The specific flaw exists within handling of firmware updates. The issue results from a fallback to a...

PT-2021-17357

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk R7800 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing...

PT-2021-17355

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk R7800 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw...