CVE-2024-52021

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at bswfix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51005

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sharename parameter at usbremotesmbconf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51015

Netgear R7000P v1.3.3.154 was discovered to contain a command injection vulnerability via the devicename2 parameter at operationmode.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-52019

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at geniefix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-52019

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at geniefix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51009

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51010

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component apmode.cgi via the apmodegateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51024

The CVE-2024-51024 entry concerns the D-Link DIR-823G router, firmware 1.0.2B05. The SetWanSettings function’s HostName parameter can be exploited to inject arbitrary OS commands, enabling remote command execution. Affected component: SetWanSettings handling of HostName; root cause: lack of prope...

CVE-2024-52018

Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the systemname parameter at geniedyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-52022

The CVE-2024-52022 issue affects Netgear R8500 (1.0.2.160), XR300 (1.0.3.78), R7000P (1.3.3.154), and R6400 v2 (1.0.4.128). It is a command-injection in the wlg_adv.cgi component exploitable via the apmode_gateway parameter, enabling an attacker to execute arbitrary OS commands through a crafted ...

CVE-2024-50999

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51008

Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the systemname parameter at wizdyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-52021

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at bswfix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-50999

Netgear R8500, v1.0.2.160, is affected by a command-injection vulnerability in the sysNewPasswd parameter of password.cgi. The issue allows an attacker to execute arbitrary OS commands via a crafted request. Public documentation consistently references Netgear R8500 v1.0.2.160 and the sysNewPassw...

CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-52020

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at wizfix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51015

Netgear R7000P (v1.3.3.154) is affected by CVE-2024-51015 through a command-injection in the operation_mode.cgi endpoint via the device_name2 parameter. The underlying issue, as documented across multiple sources, enables an attacker to execute arbitrary OS commands by sending a crafted request, ...

CVE-2024-52018

Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the systemname parameter at geniedyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51008

The CVE-2024-51008 issue affects Netgear XR300 (firmware v1.0.3.78) due to a command injection in the wiz_dyn.cgi endpoint, specifically in the system_name parameter. The underlying flaw allows an attacker to craft a request that executes arbitrary OS commands on the device, yielding a high-sever...

CVE-2024-51021

Affected devices: NETGEAR XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 (v2 1.0.4.128). Vulnerability: Command injection via the wan_gateway parameter in the genie_fix2.cgi script. This allows an attacker to craft a request that executes arbitrary OS commands on the device. Impact and severity...