CVE-2021-20174: Cleartext Transmission of Sensitive Information

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be transmitted in...

CVE-2021-20173: Improper Neutralization of Special Elements used in an OS Command

Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values...

CVE-2021-20166: Buffer Copy without Checking Size of Input

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton...

CVE-2021-20168: Improper Authentication

Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, login with default credentials, and execute commands as the root user. These default...

CVE-2021-20170: Use of Hard-coded Credentials

Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password...

CVE-2021-45732: Use of Hard-coded Credentials

Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools,...

PT-2021-13822

Name of the Vulnerable Software and Affected Versions: Netgear RAX43 version 1.0.3.96 Description: The issue arises from the use of hardcoded credentials in the Netgear RAX43. Specifically, configuration backups are encrypted using a password-protected zip file with a hardcoded password...

PT-2021-6274

Name of the Vulnerable Software and Affected Versions Netgear RAX43 version 1.0.3.96 Description The issue is caused by a buffer overrun vulnerability in the URL parsing functionality of the cgi-bin endpoint. This can allow a remote attacker to impact the confidentiality, integrity, and...

PT-2021-24196

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the storage of sensitive information in plaintext. Specifically, all usernames and passwords for the device's associated services are stored in plaintext on the device...

Netgear RAX43 buffer error vulnerability

The Netgear RAX43 is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between them. A buffer overflow vulnerability exists in Netgear RAX43 version 1.0.3.96. The vulnerability is caused by the URL parsing functionality of the...

Netgear Nighthawk R6700 encryption issue vulnerability

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the product's failure to encrypt account information. An attacker could obtain plaintext account information in the Zhu configuration file throug...

PT-2021-13824

Name of the Vulnerable Software and Affected Versions: Netgear Genie Installer for macOS affected versions not specified Description: The Netgear Genie Installer for macOS contains a local privilege escalation issue due to insecure file handling. A malicious actor with local access to the endpoin...

PT-2021-13826

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns the lack of secure communication methods to the web interface. By default, all communication to and from the device's web interface is sent via HTTP, causing potentiall...

PT-2021-13825

Name of the Vulnerable Software and Affected Versions: Netgear Nighthawk R6700 version 1.0.4.120 Description: The issue concerns a command injection vulnerability in the update functionality of the device. This vulnerability can be triggered by initiating a system update check via the SOAP...

CVE-2021-45077: Cleartext Storage of Sensitive Information

Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device...

Unspecified Vulnerability in Netgear NETGEAR (CNVD-2021-103082)

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. Certain NETGEAR devices have a security vulnerability that can be exploited by an attacker to escalate privileges...

CVE-2021-45674

Certain NETGEAR devices are affected by stored XSS. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62, RAX15 before 1.0.2.82, RAX20 before 1.0.2.82, RAX200 before 1.0.3.106, RAX75 before 1.0.3.106, and RAX80 before 1.0.3.106...

CVE-2021-45679

Certain NETGEAR devices are affected by privilege escalation. This affects R6900P before 1.3.3.140, R7000 before 1.0.11.126, R7000P before 1.3.3.140, and RS400 before 1.5.1.80...

CVE-2021-45679

Certain NETGEAR devices are affected by privilege escalation. This affects R6900P before 1.3.3.140, R7000 before 1.0.11.126, R7000P before 1.3.3.140, and RS400 before 1.5.1.80...

CVE-2021-45675

Certain NETGEAR devices are affected by stored XSS. This affects R6120 before 1.0.0.76, R6260 before 1.1.0.78, R6850 before 1.1.0.78, R6350 before 1.1.0.78, R6330 before 1.1.0.78, R6800 before 1.2.0.76, R6700v2 before 1.2.0.76, R6900v2 before 1.2.0.76, R7200 before 1.2.0.76, R7350 before 1.2.0.76...