CVE-2024-52024

Netgear XR300 v1.0.3.78 , R7000P v1.3.3.154 , and R6400 v2 1.0.4.128 are vulnerable to a stack overflow in the wizpppoe.cgi component. The root cause is a buffer copy operation that fails to check the size of input data when processing the pppoe_localip parameter. A malicious actor can exploit th...

CVE-2024-51007

Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2024-8377 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.78 Description: The issue is related to a buffer overflow in the wireless.cgi script of the Netgear XR300 router's firmware, specifically when handling the passphrase parameter. This can be exploited by a remote...

CVE-2024-51019

The Netgear R7000P wireless router (version v1.3.3.154 ) is vulnerable to a stack overflow within the pppoe.cgi script. The root cause is the failure to correctly validate the length of input data provided via the pppoe_localnetmask parameter. A remote attacker can exploit this by sending a craft...

CVE-2024-51001: Buffer Copy without Checking Size of Input

Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sysDNSHost parameter at ddns.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2024-8254 · NetGear · Netgear R6400 +3

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128 Description: The issue is related to a stack overflow vulnerability in the bsw pptp.cgi script of Netgear...

CVE-2024-52022: Improper Neutralization of Special Elements used in a Command

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlgadv.cgi via the apmodegateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51012: Buffer Copy without Checking Size of Input

Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6pridns parameter at ipv6fix.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-51009: Improper Neutralization of Special Elements used in an OS Command

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-50994: Buffer Copy without Checking Size of Input

Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6fix.cgi via the ipv6wanipaddr, ipv6lanipaddr, ipv6wanlength, and ipv6lanlength parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS via a crafted POST...

CVE-2024-50994

The Netgear R8500 router (version v1.0.2.160 ) is susceptible to multiple stack overflow vulnerabilities in the ipv6_fix.cgi component. The root cause is the lack of size checking when copying input buffers for the ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length parameters....

PT-2024-8376

Name of the Vulnerable Software and Affected Versions Netgear R8500 version 1.0.2.160 Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128 Description The issue is related to a stack overflow vulnerability via the l2tp user ip parameter at the...

CVE-2024-51013: Buffer Copy without Checking Size of Input

Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the RADIUSAddr%dwla parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2024-8370

Name of the Vulnerable Software and Affected Versions Netgear R8500 version 1.0.2.160 Description The issue is related to multiple stack overflow vulnerabilities in the wireless.cgi component of the Netgear R8500 router's firmware. These vulnerabilities are caused by uncontrolled copying of user...

CVE-2024-51001

The Netgear R8500 wireless router, specifically version v1.0.2.160 , is vulnerable to a stack overflow in the ddns.cgi component. The root cause is a failure to correctly validate the length of input data when processing the sysDNSHost parameter, specifically during buffer copying operations. A r...

CVE-2024-52026

Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoelocalip parameter at bswpppoe.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-51000

The Netgear R8500 wireless router (version v1.0.2.160 ) contains multiple stack overflow vulnerabilities in the wireless.cgi component. The root cause is the copying of buffers without sufficient input size validation during the processing of the opmode , opmode_an , and opmode_an_2 parameters. A...

CVE-2024-52019

The Netgear R8500 (version 1.0.2.160) is vulnerable to a command injection vulnerability within the genie_fix2.cgi component. The flaw exists because the wan_gateway parameter fails to properly neutralize or filter special characters used in operating system commands. A remote attacker can exploi...

CVE-2024-52015

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptpuserip parameter at bswpptp.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-50998: Buffer Copy without Checking Size of Input

Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpnserviceport and openvpnserviceporttun parameters. These vulnerabilities allow attackers to cause a Denial of Service DoS via a crafted POST request...