Patch now! Netgear fixes serious smart switch vulnerabilities

In a security advisory, NetGear has announced it has fixed three vulnerabilities in firmware updates for several network devices. Most of the affected products are smart switches, some of them with cloud management capabilities that allow for configuring and monitoring them over the web. One of t...

Critical Auth Bypass Bug Affect NETGEAR Smart Switches — Patch and PoC Released

Networking, storage and security solutions provider Netgear on Friday issued patches to address three security vulnerabilities affecting its smart switches that could be abused by an adversary to gain full control of a vulnerable device. The flaws, which were discovered and reported to Netgear by...

Netgear PNPX_GetShareFolderList Authentication Bypass

This module targets an authentication bypass vulnerability in the minihttp binary of several Netgear Routers running firmware versions prior to 1.2.0.88, 1.0.1.80, 1.1.0.110, and 1.1.0.84. The vulnerability allows unauthenticated attackers to reveal the password for the admin user that is used to...

PT-2021-5337 · NetGear · Gs752Tpp +16

Name of the Vulnerable Software and Affected Versions: NETGEAR GC108P versions prior to 1.0.8.2 NETGEAR GC108PP versions prior to 1.0.8.2 NETGEAR GS108Tv3 versions prior to 7.0.7.2 NETGEAR GS110TPP versions prior to 7.0.7.2 NETGEAR GS110TPv3 versions prior to 7.0.7.2 NETGEAR GS110TUP versions pri...

NETGEAR Multiple Routers mini_httpd Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the minihttpd service, which listens on TCP port 80 by default. The...

PT-2021-20710 · NetGear · Netgear Routers

Name of the Vulnerable Software and Affected Versions: NETGEAR Multiple Routers affected versions not specified Description: This issue allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. No authentication is required to exploit this...

NETGEAR 授权问题漏洞

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. An authorization issue vulnerability exists in multiple NETGEAR router devices, which stems from the minihttpd service in the product not...

PT-2021-5887 · NetGear · Netgear R6260 +16

Name of the Vulnerable Software and Affected Versions: NETGEAR AC2100 versions prior to 2021-08-27 NETGEAR AC2400 versions prior to 2021-08-27 NETGEAR AC2600 versions prior to 2021-08-27 NETGEAR D7000 versions prior to 2021-08-27 NETGEAR R6220 versions prior to 2021-08-27 NETGEAR R6230 versions...

Mozi IoT Botnet Now Also Targets Netgear, Huawei, and ZTE Network Gateways

Mozi, a peer-to-peer P2P botnet known to target IoT devices, has gained new capabilities that allow it to achieve persistence on network gateways manufactured by Netgear, Huawei, and ZTE, according to latest findings. "Network gateways are a particularly juicy target for adversaries because they...

How to proactively defend against Mozi IoT botnet

Mozi is a peer-to-peer P2P botnet that uses a BitTorrent-like network to infect IoT devices such as network gateways and digital video records DVRs. It works by exploiting weak telnet passwords1 and nearly a dozen unpatched IoT vulnerabilities2 and it’s been used to conduct distributed...

SQL Injection Vulnerability in Netnifty's Internet Behavior Management System Leadsec ACM

Beijing Nethub Information Technology Co., Ltd. was renamed from Lenovo Nethub Technology Beijing Co., Ltd. and its business covers network border security protection, application and data security protection, network-wide security risk management, professional security solutions and professional...

NetGear D1500 V1.0.0.21_1.0.1PE - (Wireless Repeater) Stored Cross-Site Scripting Vulnerability

Exploit Title: NetGear D1500 V1.0.0.211.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting XSS Exploit Author: Securityium Vendor Homepage: https://www.netgear.com/ Version: V1.0.0.211.0.1PE Tested on: NetGear D1500 Home Router Contact: email protected Version : Hardware version:...

NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)

Exploit Title: NetGear D1500 V1.0.0.211.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting XSS Date: 21 Dec 2018 Exploit Author: Securityium Vendor Homepage: https://www.netgear.com/ Version: V1.0.0.211.0.1PE Tested on: NetGear D1500 Home Router Contact: [email protected] Version :...

NetGear D1500 1.0.0.21_1.0.1PE Cross Site Scripting

Exploit Title: NetGear D1500 V1.0.0.211.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting XSS Date: 21 Dec 2018 Exploit Author: Securityium Vendor Homepage: https://www.netgear.com/ Version: V1.0.0.211.0.1PE Tested on: NetGear D1500 Home Router Contact: [email protected] Version :...

Netgear RBR750 Access Control Error Vulnerability

Netgear RBR750 is a home WiFi system from Netgear, Inc. Multiple NETGEAR devices are vulnerable to an access control error, which stems from the product not properly restricting access from unauthorized roles. No details of the vulnerability are currently available...

Multiple NETGEAR device command injection vulnerabilities

Netgear NETGEAR is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks. Multiple NETGEAR devices are vulnerable to command injection. The vulnerability stems from the product's failure to filter special characters in user input...

NETGEAR Multiple Products Command Injection Vulnerability

Netgear NETGEAR is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks. Several NETGEAR devices have a security vulnerability that stems from the product's failure to filter special characters in user input data, which could allo...

CVE-2021-38539

Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before 1.0.2.66, R6900 before 1.0.2.4, R6900P before 1.3.2.126, R7000 before 1.0.9.42, R7000P before 1.3.2.126, R7100LG before 1.0.0.50, R7300DS...

CVE-2021-38539

Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before 1.0.2.66, R6900 before 1.0.2.4, R6900P before 1.3.2.126, R7000 before 1.0.9.42, R7000P before 1.3.2.126, R7100LG before 1.0.0.50, R7300DS...

CVE-2021-38538

Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7800 before 1.0.2.68, R8900 before 1.0.4.26, R9000 before 1.0.4.26, RAX120 before 1.0.0.78, RBK20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK40 before 2.3.5.30, RBR40 before 2.3.5.30,...