NETGEAR R8500、XR300、R7000P和R6400v2 安全漏洞

NETGEAR R6400v2 and others are products of NETGEAR USA.NETGEAR R6400v2 is a router.NETGEAR R7000P is a wireless router.NETGEAR XR300 is a wireless router. A security vulnerability exists in NETGEAR R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128, which originates from...

CVE-2024-51018

Netgear R7000P v1.3.3.154 contains a stack overflow in the pptp.cgi component, triggered by the pptp_user_netmask parameter, enabling a Denial of Service via a crafted POST request. Sources consistently identify the affected endpoint and vulnerability class, with no patch version provided in the ...

NETGEAR XR300、R7000P和R6400v2 安全漏洞

NETGEAR R6400v2 and others are products of NETGEAR Corporation USA.NETGEAR R6400v2 is a router.NETGEAR R7000P is a wireless router.NETGEAR XR300 is a wireless router. A security vulnerability exists in NETGEAR XR300 version v1.0.3.78, R7000P version v1.3.3.154, and R6400v2 version 1.0.4.128, whic...

CVE-2024-52023

Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoelocalip parameter at pppoe2.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-52018

Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the systemname parameter at geniedyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51004

Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usbdevice.cgi via the cifsuser, readaccess, and writeaccess parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-51004

Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usbdevice.cgi via the cifsuser, readaccess, and writeaccess parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2024-8265 · NetGear · Netgear R7000P

Name of the Vulnerable Software and Affected Versions: Netgear R7000P version 1.3.3.154 Description: The issue is related to a stack overflow in the ru wan flow.cgi script, specifically via the pptp user netmask parameter. This allows attackers to cause a Denial of Service DoS by sending a crafte...

CVE-2024-51018

Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptpusernetmask parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-52025

The CVE-2024-52025 entry affects Netgear XR300 (v1.0.3.78), R7000P (v1.3.3.154), and R6400v2 (v1.0.4.128). A stack overflow in the geniepppoe.cgi component is triggered by processing the pppoe_localip parameter, allowing remote attackers to cause a Denial of Service via a crafted POST request. Pu...

CVE-2024-51007

CVE-2024-51007 concerns Netgear XR300 wireless router firmware, specifically version 1.0.3.78 . The vulnerability is a stack overflow in the wireless.cgi component triggered by the passphrase parameter, which can be exploited by a remote attacker to cause a Denial of Service (DoS) via a crafted P...

CVE-2024-51003

Affected software and component: Netgear R8500 (v1.0.2.160), XR300 (v1.0.3.78), R7000P (v1.3.3.154), and R6400 v2 (v1.0.4.128) with the vulnerable ap_mode.cgi component. Vulnerability details: Multiple stack overflow vulnerabilities in ap_mode.cgi can be triggered via the parameters apmode_dns1_p...

CVE-2024-51002

The CVE-2024-51002 entry describes a stack overflow vulnerability in Netgear devices: R8500 (v1.0.2.160), XR300 (v1.0.3.78), R7000P (v1.3.3.154), and R6400v2 (v2 1.0.4.128) caused by the l2tp_user_ip parameter in l2tp.cgi. Successful exploitation can trigger a Denial of Service via a crafted POST...

CVE-2024-52030

Netgear R7000P v1.3.3.154 is affected by a stack/buffer overflow in ru_wan_flow.cgi triggered via the pptp_user_netmask parameter. A crafted POST request can cause Denial of Service (DoS). Some sources additionally note potential arbitrary-code concerns, but the primary detail is DoS via a crafte...

CVE-2024-51019

Netgear R7000P v1.3.3.154 contains a stack overflow in the pppoe.cgi component triggered by the pppoe_localnetmask parameter. A crafted POST request can cause a Denial of Service (DoS). Public sources diverge on whether arbitrary code execution is possible; several CNVD/Red Hat/NVD variants descr...

CVE-2024-52018

CVE-2024-52018 affects Netgear XR300 v1.0.3.78. A command-injection vulnerability exists in the genie_dyn.cgi endpoint through the system_name parameter, allowing an attacker to execute arbitrary OS commands via a crafted request. From the provided documents, the CVSS v3.1 base score is 8.0 (HIGH...

CVE-2024-52028

CVE-2024-52028 affects NETGEAR R7000P (firmware v1.3.3.154). The vulnerability is a stack/buffer overflow in the wiz_pptp.cgi component, caused by improper handling of the pptp_user_netmask parameter, which can be triggered by a crafted POST request to trigger a Denial of Service. Multiple connec...

CVE-2024-52020

Netgear R8500 v1.0.2.160 is affected by a command-injection vulnerability in the wan_gateway parameter of wiz_fix2.cgi. The issue arises from improper neutralization of special elements in the operating-system command when processing the wan_gateway parameter, enabling an attacker to execute arbi...

CVE-2024-51016

CVE-2024-51016 affects Netgear XR300 v1.0.3.78 and is caused by a stack overflow in the addName%d parameter of the usb_approve.cgi script, exploitable by a crafted POST request to induce a DoS. The available documents consistently describe a buffer/stack overflow in usb_approve.cgi without citing...

CVE-2024-51022

Netgear XR300, v1.0.3.78, contains a stack overflow in bridge_wireless_main.cgi when processing the ssid parameter, allowing a crafted POST to cause a Denial of Service. Public details across NVD/Red Hat/CVE records confirm the issue but do not provide an attacker’s exploit vector beyond the POST...