CVE-2019-12513: Improper Neutralization of Input During Web Page Generation

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious...

CVE-2019-12512: Improper Neutralization of Input During Web Page Generation

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanc...

CVE-2019-12511: Improper Neutralization of Special Elements used in an OS Command

In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled...

The vulnerability of the CGI processor (wlg_adv.cgi) in Netgear Nighthawk’s embedded software allows a hacker to execute arbitrary commands.

The vulnerability of the CGI processor wlgadv.cgi in Netgear Nighthawk router’s embedded software is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

NETGEAR Nighthawk M1 OS Command Injection Vulnerability

The NETGEAR Nighthawk M1 is a portable wireless router from NETGEAR. An operating system command injection vulnerability exists in the NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03. An attacker can exploit this vulnerability to execute system commands via the web interface...

NETGEAR Nighthawk M1 Cross-Site Request Forgery Vulnerability

The NETGEAR Nighthawk M1 is a portable wireless router from NETGEAR. A cross-site request forgery vulnerability exists in the NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a...

CVE-2019-14526

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

CVE-2019-14527

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

CVE-2019-14527

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

CVE-2019-14526

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

Authentication flaw

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

Design/Logic Flaw

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

CVE-2019-14527

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

CVE-2019-14527

CVE-2019-14527 affects NETGEAR Nighthawk M1 (MR1100) prior to version 12.06.03. The connected sources describe a post-authentication command injection vulnerability in the device’s web interface, enabling an authenticated attacker to execute system commands on the router. This is tied to the same...

CVE-2019-14526

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

CVE-2019-14526

The CVE-2019-14526 entry covers NETGEAR Nighthawk M1 (MR1100) before 12.06.03 where the CSRF protection token is written to a dynamically generated JavaScript file and can be embedded in third‑party pages, enabling token bypass. The vulnerability is due to CSRF token exposure in NetgearStrings.js...

PT-2019-13733

Name of the Vulnerable Software and Affected Versions NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03 Description An issue allows the web-interface Cross-Site Request Forgery token to be stored in a dynamically generated JavaScript file. This token can be embedded in third-party pages and...

CVE-2019-14527: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

CVE-2019-14526: Cross-Site Request Forgery (CSRF)

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

PT-2019-13734

Name of the Vulnerable Software and Affected Versions NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03 Description An issue allows system commands to be executed via the web interface after authentication. Recommendations For versions prior to 12.06.03, update to version 12.06.03 or later t...