CVE-2024-50994

CVE-2024-50994 affects Netgear R8500 with v1.0.2.160, where multiple stack overflow vulnerabilities exist in the ipv6_fix.cgi component triggered by ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length. The crash/overflow can be induced by a crafted POST request and is described...

CVE-2024-52017

CVE-2024-52017 affects Netgear XR300 (v1.0.3.78). The issue arises from a stack overflow in the passphrase parameter of bridge_wireless_main.cgi, exploitable via a crafted POST request to trigger a Denial of Service. The Red Hat, CNVD, CNNVD, NVD, CVE list entries align on this description. The a...

CVE-2024-50999

Netgear R8500, v1.0.2.160, is affected by a command-injection vulnerability in the sysNewPasswd parameter of password.cgi. The issue allows an attacker to execute arbitrary OS commands via a crafted request. Public documentation consistently references Netgear R8500 v1.0.2.160 and the sysNewPassw...

CVE-2024-51006

CVE-2024-51006 affects Netgear R8500 v1.0.2.160, with a stack overflow in the ipv6_tunnel function triggered by the ipv6_static_ip parameter. Multiple sources (NVD, Red Hat, CNVD, CVE/CVELIST) describe a Denial of Service potential via a crafted POST request, with no official disclosure of exploi...

CVE-2024-52026

CVE-2024-52026 affects Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128. A stack overflow in the router firmware's bsw_pppoe.cgi script is triggered by the pppoe_localip parameter, allowing remote attackers to cause a Denial of Service via a crafted POST request. Some connected ...

CVE-2024-52019

CVE-2024-52019 affects Netgear R8500 v1.0.2.160 via a command injection vulnerability in the wan_gateway parameter of the genie_fix2.cgi endpoint. The root cause is inadequate input filtering of command-related characters, enabling an attacker to execute arbitrary OS commands under low privileges...

CVE-2024-52022

The CVE-2024-52022 issue affects Netgear R8500 (1.0.2.160), XR300 (1.0.3.78), R7000P (1.3.3.154), and R6400 v2 (1.0.4.128). It is a command-injection in the wlg_adv.cgi component exploitable via the apmode_gateway parameter, enabling an attacker to execute arbitrary OS commands through a crafted ...

CVE-2024-51015

Netgear R7000P (v1.3.3.154) is affected by CVE-2024-51015 through a command-injection in the operation_mode.cgi endpoint via the device_name2 parameter. The underlying issue, as documented across multiple sources, enables an attacker to execute arbitrary OS commands by sending a crafted request, ...

PT-2024-8525 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: A command injection issue has been discovered in the wan gateway parameter at the "ether.cgi" endpoint. This allows attackers to execute arbitrary OS commands via a crafted request. The vulnerabili...

PT-2024-8539 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.78 Description: The issue is related to a stack overflow in the addName%d parameter of the usb approve.cgi script, which can be exploited by sending a specially crafted POST request. This can allow a remote attacke...

PT-2024-8391 · NetGear · Netgear Xr300 +3

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128 Description: A command injection issue was discovered in the ap mode.cgi component of Netgear routers,...

PT-2024-8390 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a command injection vulnerability in the share name parameter at the "usb remote smb conf.cgi" endpoint. This vulnerability allows attackers to execute arbitrary OS commands...

PT-2024-8535 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.78 Description: The issue is related to a command injection vulnerability in the system name parameter at the "wiz dyn.cgi" endpoint. This vulnerability can be exploited by sending a specially crafted request,...

PT-2024-8537 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a stack overflow in the pppoe.cgi script when handling the pppoe localnetmask parameter. This allows attackers to cause a Denial of Service DoS via a crafted POST request t...

PT-2024-8389 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a stack overflow vulnerability in the wireless.cgi script of the NETGEAR R7000P router's firmware, specifically when handling the RADIUSAddr%d wla parameter. This can be...

PT-2024-8378 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a stack overflow vulnerability in the ipv6 fix.cgi script of the NETGEAR R8500 router's firmware, specifically when handling the ipv6 pri dns parameter. This can be exploite...

PT-2024-8545 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a stack overflow in the pptp user netmask parameter at the "pptp.cgi" endpoint. This allows attackers to cause a Denial of Service DoS via a crafted POST request. The...

PT-2024-9811 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a stack overflow in the ipv6 tunnel function when handling the ipv6 static ip parameter. This can be exploited by a remote attacker to cause a Denial of Service DoS using a...

PT-2024-8543 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a command injection vulnerability via the device name2 parameter at the "operation mode.cgi" endpoint. This allows attackers to execute arbitrary OS commands via a crafted...

PT-2024-8387 · NetGear · Netgear R8500 +1

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Netgear R7000P version 1.3.3.154 Description: The issue is related to multiple stack overflow vulnerabilities in the usb device.cgi component of Netgear routers. These vulnerabilities can be exploited via the...