CVE-2023-38412

Netgear R6900P v1.3.3.154 was discovered to contain multiple buffer overflows via the wlassid and wlgssid parameters at iaapsetting.cgi...

CVE-2023-38921

Netgear WG302v2 (v5.2.9) and WAG302v2 (v5.1.19) are affected by command injection vulnerabilities in the upgrade_handler function, exploitable via the firmwareRestore and firmwareServerip parameters. Root cause is improper handling of those inputs leading to potential arbitrary command execution....

CVE-2023-38412

CVE-2023-38412 concerns a buffer overflow in NETGEAR R6900P v1.3.3.154, triggered by malformed input to ia_ap_setting.cgi through the wla_ssid and wlg_ssid parameters. The available connected sources describe multiple buffer overflows and state that exploitation could allow remote code execution ...

CVE-2023-36499

Netgear XR300 v1.0.3.78 was discovered to contain multiple buffer overflows via the wlassid and wlgssid parameters at genieapwifichange.cgi...

CVE-2023-38928

The CVE concerns Netgear R7100LG firmware 1.0.0.78 with a command injection in usb_remote_invite.cgi through the password parameter, enabling arbitrary command execution. Affected component is the router’s web/CGI endpoint; root cause is improper filtering of constructed command characters in the...

NETGEAR DC112A and EX6200 and R6300v2 Security Vulnerabilities

NETGEAR DC112A and others are products of NETGEAR Corporation.NETGEAR DC112A is a wireless router.NETGEAR EX6200 is a wireless network signal extender.NETGEAR R6300v2 is a wireless router. A security vulnerability exists in the NETGEAR DC112A version 1.0.0.64, EX6200 version 1.0.3.94, and R6300v2...

CVE-2023-38591

Netgear DG834Gv5 (version 1.6.01.34) contains multiple buffer overflow vulnerabilities in the web interface. Specifically, input length validation failures exist in the wla_ssid and wla_temp_ssid parameters exposed via bsw_ssid.cgi, enabling potential remote code execution or denial of service as...

NETGEAR JWNR2000 and XWN5001 and XAVN2001 Security Vulnerabilities

NETGEAR XWN5001 and NETGEAR JWNR2000 are both products of NETGEAR Corporation.NETGEAR XWN5001 is a wireless access point.NETGEAR JWNR2000 is a wireless router. A security vulnerability exists in NETGEAR JWNR2000v2 v1.0.0.11, XWN5001 v0.4.1.1, and XAVN2001v2 v0.4.0.7, which stems from a multiple...

CVE-2023-38928

Netgear R7100LG 1.0.0.78 was discovered to contain a command injection vulnerability via the password parameter at usbremoteinvite.cgi...

PT-2023-26691 · NetGear · Netgear R7100Lg

Name of the Vulnerable Software and Affected Versions: Netgear R7100LG version 1.0.0.78 Description: A command injection issue was discovered via the password parameter at the "usb remote invite.cgi" endpoint. This allows for potential exploitation. Recommendations: For Netgear R7100LG version...

PT-2023-26524 · NetGear · Netgear Dg834Gv5

Name of the Vulnerable Software and Affected Versions: Netgear DG834Gv5 version 1.6.01.34 Description: The issue concerns multiple buffer overflows that can be triggered via the wla ssid and wla temp ssid parameters at the "bsw ssid.cgi" endpoint. Recommendations: For Netgear DG834Gv5 version...

CVE-2023-39550

CVE-2023-39550 affects Netgear devices: JWNR2000v2 (v1.0.0.11), XWN5001 (v0.4.1.1), and XAVN2001v2 (v0.4.0.7). The issue is multiple buffer overflows in the check_auth function triggered via the http_passwd and http_username parameters. Impact, as per CVSS data, is high (Network attack, no user i...

NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of NETGEAR ProSAFE Network Management System. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MyHandlerInterceptor class. The issue results from improper...

NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...

NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...

NETGEAR ProSAFE Network Management System SettingConfigController Exposed Dangerous Function Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...

NETGEAR ProSAFE Network Management System BkreProcessThread Exposed Dangerous Function Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...

The vulnerability of the system() function in NETGEAR RAX30 microprogramming devices allows a hacker to execute arbitrary code.

The vulnerability of the system function in NETGEAR RAX30 microprogramming devices stems from insufficient validation of input data during the processing of port discovery requests via UPnP. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the update function in NETGEAR RAX50 integrated software allows a hacker to execute arbitrary code.

The vulnerability of the update function in NETGEAR RAX50 integrated software lies in errors in the certificate validation process. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted CURL POST request...