High-Severity RCE Flaw Disclosed in Several Netgear Router Models

Networking equipment company Netgear has released patches to remediate a high-severity remote code execution vulnerability affecting multiple routers that could be exploited by remote attackers to take control of an affected system. Traced as CVE-2021-40847 CVSS score: 8.1, the security weakness...

Multiple NETGEAR Switches Vulnerable to Licensing Issues

Netgear NETGEAR is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks. A variety of NETGEAR switches are vulnerable to an authorization issue, which stems from a password field in the product's Web UI that fails to properly hand...

CVE-2021-40847

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

CVE-2021-40847

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

Remote code execution

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

CVE-2021-40847

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

CVE-2021-40847

CVE-2021-40847 affects Netgear routers through the Circle parental controls update mechanism. The Circle update daemon (circled), enabled by default, fetches unsigned updates over HTTP and, under a MitM, can be tricked into delivering a crafted compressed database that overwrites executables with...

CVE-2021-40847

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

NETGEAR Releases Security Updates for RCE Vulnerability

NETGEAR has released security updates to address a remote code execution vulnerability—CVE-2021-40847—in multiple NETGEAR routers. A remote attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review NETGEAR’s Security Adviso...

NETGEAR Code Injection Vulnerability

Netgear NETGEAR is a router from Netgear, an American company. NETGEAR routers have a security vulnerability that could allow remote attackers to remotely execute code as root via a MitM attack during updates to the Circle parental control service...

PT-2021-4799

Name of the Vulnerable Software and Affected Versions NETGEAR R6400v2 version 1.0.4.106 NETGEAR R6700 version 1.0.2.16 NETGEAR R6700v3 version 1.0.4.106 NETGEAR R6900 version 1.0.2.16 NETGEAR R6900P version 1.3.2.134 NETGEAR R7000 version 1.0.11.123 NETGEAR R7000P version 1.3.2.134 NETGEAR R7850...

NETGEAR R6020 Command Injection Vulnerability

The NETGEAR R6020 is a router from Netgear, Inc. NETGEAR R6020 is vulnerable to a command injection vulnerability in version 1.0.0.48, which stems from a lack of validation and filtering in the ntpserver field of setup.cgi. An attacker with administrator status can use this vulnerability to injec...

CVE-2021-41383

setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...

CVE-2021-41383

setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...

Code injection

setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...

CVE-2021-41383

setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...

CVE-2021-41383

setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...

CVE-2021-41383

CVE-2021-41383 affects NETGEAR R6020 router firmware 1.0.0.48. Vulnerability arises from lack of validation/filtering in setup.cgi ntp_server field, allowing an administrator to inject shell commands and execute arbitrary commands on the device. Exploitation details are not provided in the availa...

CVE-2021-41383: Improper Neutralization of Special Elements used in a Command

setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...

Vulnerabilities fixed in Netgear SmartSwitches

Netgear has fixed three vulnerabilities in a large number of SmartSwitches Seventh Inferno, Demon's Cries and Draconian Fear. The vulnerabilities allow a malicious party to cause a denial-of-service, or, when the vulnerabilities are used in tandem, to reset the password of the local admin reset...