CVE-2019-12512: Improper Neutralization of Input During Web Page Generation

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanc...

CVE-2019-12511: Improper Neutralization of Special Elements used in an OS Command

In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled...

PT-2020-9329

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk X10-R900 versions prior to 1.0.4.26 Description: The issue allows an attacker to bypass authentication checks on the device's "NETGEAR Genie" SOAP API by supplying a malicious X-Forwarded-For header with the device's LAN IP...

PT-2020-9331

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk X10-R900 versions prior to 1.0.4.24 Description: The issue allows an attacker to execute stored XSS attacks against the device by supplying a malicious X-Forwarded-For header during an incorrect login attempt. The supplied...

PT-2020-9330

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk X10-R9000 versions prior to 1.0.4.26 Description: The issue allows an attacker to execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at...

CVE-2019-12510: Insufficient Verification of Data Authenticity

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API "/soap/serversa" by supplying a malicious X-Forwarded-For header of the device's LAN IP address 192.168.1.1 in every request. As a result, an attacker may...

The vulnerability of the CGI processor (wlg_adv.cgi) in Netgear Nighthawk’s embedded software allows a hacker to execute arbitrary commands.

The vulnerability of the CGI processor wlgadv.cgi in Netgear Nighthawk router’s embedded software is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

NETGEAR Nighthawk M1 OS Command Injection Vulnerability

The NETGEAR Nighthawk M1 is a portable wireless router from NETGEAR. An operating system command injection vulnerability exists in the NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03. An attacker can exploit this vulnerability to execute system commands via the web interface...

NETGEAR Nighthawk M1 Cross-Site Request Forgery Vulnerability

The NETGEAR Nighthawk M1 is a portable wireless router from NETGEAR. A cross-site request forgery vulnerability exists in the NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a...

CVE-2019-14526

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

CVE-2019-14527

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

CVE-2019-14526

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

Design/Logic Flaw

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

PT-2019-13733

Name of the Vulnerable Software and Affected Versions NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03 Description An issue allows the web-interface Cross-Site Request Forgery token to be stored in a dynamically generated JavaScript file. This token can be embedded in third-party pages and...

CVE-2019-14527: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

CVE-2019-14526: Cross-Site Request Forgery (CSRF)

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

PT-2019-13734

Name of the Vulnerable Software and Affected Versions NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03 Description An issue allows system commands to be executed via the web interface after authentication. Recommendations For versions prior to 12.06.03, update to version 12.06.03 or later t...

Breaking (Bad) Cross-Site Request Forgery Protection – The Netgear Nighthawk M1

What is CSRF? Cross-site Request Forgery CSRF is a descriptive term, but pretty oblique if you don’t know exactly what it means. Broken down, it’s pretty simple: A malicious web page running in your browser can send requests to other sites. When it sends those requests, it’ll use the current...

Breaking (bad) firmware encryption. Case study on the Netgear Nighthawk M1

TL;DR The firmware encryption for the Netgear Nighthawk M1 is mainly XOR. It’s possible to derive the XOR key by statistical analysis, just from the firmware update file itself. It’s then possible to extract an AES key from what’s XOR’d, which can be used to decrypt other parts of the firmware...

CVE-2019-5016

An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least two NETGEAR Nighthawk Routers and potentially several other vendors/products. A specially crafted index value can cause an invalid memory...