NETGEAR R8500 安全漏洞

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the wangateway parameter in the bswfix.cgi component failing to correctly filter constructed command special characters, commands, and so on. An attacker...

CVE-2024-52024

Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoelocalip parameter at wizpppoe.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2024-8256 · NetGear · Netgear R6400V2 +2

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128 Description: The issue is related to a stack overflow vulnerability via the pppoe localip parameter at the "pppoe2.cgi" endpoint. This allows...

CVE-2024-50999

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51017

Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the l2tpusernetmask parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-52019

CVE-2024-52019 affects Netgear R8500 v1.0.2.160 via a command injection vulnerability in the wan_gateway parameter of the genie_fix2.cgi endpoint. The root cause is inadequate input filtering of command-related characters, enabling an attacker to execute arbitrary OS commands under low privileges...

CVE-2024-51008

The CVE-2024-51008 issue affects Netgear XR300 (firmware v1.0.3.78) due to a command injection in the wiz_dyn.cgi endpoint, specifically in the system_name parameter. The underlying flaw allows an attacker to craft a request that executes arbitrary OS commands on the device, yielding a high-sever...

PT-2024-8320 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a remote attacker to execute arbitrary commands by sending a specially...

CVE-2024-52019

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at geniefix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

NETGEAR R8500 安全漏洞

The NETGEAR R8500 is a wireless router from NETGEAR. A buffer overflow vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the ipv6pridns parameter in the ipv6fix.cgi component that fails to correctly validate the length of the incoming data, and can be exploited by a remote...

NETGEAR R8500 安全漏洞

The NETGEAR R8500 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R8500 v1.0.2.160, which stems from the wangateway parameter in the geniefix2.cgi component failing to correctly filter constructed command special characters, commands, and so on. An...

CVE-2024-51010

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component apmode.cgi via the apmodegateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-52029

Netgear R7000P v1.3.3.154 is affected by a stack overflow in the genie_pptp.cgi component due to the pptp_user_netmask parameter. This can be triggered by a crafted POST request and results in a Denial of Service. The available connected documents do not provide a patched version or formal remedi...

CVE-2024-50994

CVE-2024-50994 affects Netgear R8500 with v1.0.2.160, where multiple stack overflow vulnerabilities exist in the ipv6_fix.cgi component triggered by ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length. The crash/overflow can be induced by a crafted POST request and is described...

CVE-2024-51011

Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoelocalip parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2024-51015

Netgear R7000P (v1.3.3.154) is affected by CVE-2024-51015 through a command-injection in the operation_mode.cgi endpoint via the device_name2 parameter. The underlying issue, as documented across multiple sources, enables an attacker to execute arbitrary OS commands by sending a crafted request, ...

CVE-2024-51004

Netgear R8500 (v1.0.2.160) and R7000P (v1.3.3.154) expose multiple stack overflow vulnerabilities in the usb_device.cgi component, exploitable via cifs_user, read_access, and write_access parameters. A crafted POST to the /usb_device.cgi endpoint can cause a Denial of Service. Connected sources c...

CVE-2024-50997

Netgear R8500 (v1.0.2.160), XR300 (v1.0.3.78), R7000P (v1.3.3.154), and R6400 v2 (v1.0.4.128) are affected by a stack overflow in the pptp.cgi component triggered by the pptp_user_ip parameter, enabling Denial of Service via a crafted POST to /pptp.cgi. Technical details are consistent across mul...

CVE-2024-50999

Netgear R8500, v1.0.2.160, is affected by a command-injection vulnerability in the sysNewPasswd parameter of password.cgi. The issue allows an attacker to execute arbitrary OS commands via a crafted request. Public documentation consistently references Netgear R8500 v1.0.2.160 and the sysNewPassw...

CVE-2024-50993

CVE-2024-50993 affects Netgear R8500 (v1.0.2.160). The issue is a command injection in the sysNewPasswd parameter of the admin_account.cgi endpoint that enables arbitrary OS command execution. The CVSS 3.1 score is 8.0 (High) with adjacent access, low attack complexity, and no user interaction re...