Netgear RAX43 security vulnerabilities

The Netgear RAX43 is a wireless router from Netgear USA. A security vulnerability exists in the Netgear RAX43 that stems from storing sensitive information in plaintext. All usernames and passwords for device-related services are stored on the device in plaintext. No details of the vulnerability...

PT-2021-6249

Name of the Vulnerable Software and Affected Versions Netgear RAX43 version 1.0.3.96 Description The issue is related to a command injection vulnerability in the readycloud cgi application, specifically in the name parameter. This vulnerability is due to the lack of input data sanitization, which...

PT-2021-13821

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue concerns insufficient protections on the UART interface. A malicious actor with physical access to the device can connect to the UART port via a serial connection, login with default...

PT-2021-13823

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue concerns the storage of sensitive information in plaintext. Specifically, all usernames and passwords for the device's associated services are stored in plaintext on the device. For...

Netgear Nighthawk R6700 authorization issue vulnerability

The Netgear Nighthawk R6700 is a wireless router from Netgear USA. An authorization issue vulnerability exists in the Netgear Nighthawk R6700 that stems from the product's lack of adequate protection for UART console access. The vulnerability can be exploited by an attacker to execute commands as...

Netgear RAX43 command injection vulnerability

Netgear RAX43 is a wireless router from Netgear, Inc. A command injection vulnerability exists in Netgear RAX43, which stems from the inclusion of a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter. No details of the...

Netgear RAX43 authorization issue vulnerability

The Netgear RAX43 is a wireless router from Netgear, Inc. A security vulnerability exists in the Netgear RAX43, which stems from insufficient protection of the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, log in...

PT-2021-13827

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the lack of secure communication methods to the SOAP interface. By default, all communication to and from the device's SOAP Interface on port 5000 is sent via HTTP,...

CVE-2021-23147: Improper Authentication

Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication...

Netgear Nighthawk R6700 has a vulnerability related to information leakage

An information disclosure vulnerability exists in the Netgear Nighthawk R6700, a wireless router from Netgear, which stems from the product's failure to encrypt HTTP requests. An attacker could gain access to sensitive information through this vulnerability...

Netgear Nighthawk R6700 operating system command injection vulnerability

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. A command injection vulnerability exists in the Netgear Nighthawk R6700, which stems from the fact that the product supports update checking via the soap interface and can be injected with a pre-set value. No details of the...

CVE-2021-20167: Improper Neutralization of Special Elements used in a Command

Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter...

CVE-2021-20172: Incorrect Permission Assignment for Critical Resource

All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which the software is going to be...

PT-2021-15393

Name of the Vulnerable Software and Affected Versions Netgear Nighthawk R6700 version 1.0.4.120 Description The issue concerns insufficient protections for the UART console, allowing a malicious actor with physical access to the device to connect to the UART port via a serial connection and execu...

PT-2021-24295

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns a hardcoded credential in the Netgear Nighthawk R6700. Although configuration backups are encrypted or obfuscated, suggesting they are not intended for user manipulatio...

Netgear Nighthawk R6700 encryption issue vulnerability

Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the product's failure to use the soap secure communication method. An attacker could obtain sensitive information from HTTP requests through this...

PT-2021-6220

Name of the Vulnerable Software and Affected Versions Netgear RAX43 version 1.0.3.96 Description The issue is related to the transmission of data in cleartext through the web interface of the affected device. This could allow an attacker to impact the confidentiality, integrity, and availability ...

CVE-2021-20169: Cleartext Transmission of Sensitive Information

Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be transmitted in cleartext...

CVE-2021-20171: Cleartext Storage of Sensitive Information

Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device...

CVE-2021-20174: Cleartext Transmission of Sensitive Information

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be transmitted in...