CVE-2024-52018

CVE-2024-52018 affects Netgear XR300 v1.0.3.78. A command-injection vulnerability exists in the genie_dyn.cgi endpoint through the system_name parameter, allowing an attacker to execute arbitrary OS commands via a crafted request. From the provided documents, the CVSS v3.1 base score is 8.0 (HIGH...

CVE-2024-51008

Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the systemname parameter at wizdyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51010

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component apmode.cgi via the apmodegateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51023

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51024

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-50993

CVE-2024-50993 affects Netgear R8500 (v1.0.2.160). The issue is a command injection in the sysNewPasswd parameter of the admin_account.cgi endpoint that enables arbitrary OS command execution. The CVSS 3.1 score is 8.0 (High) with adjacent access, low attack complexity, and no user interaction re...

CVE-2024-50999

Netgear R8500, v1.0.2.160, is affected by a command-injection vulnerability in the sysNewPasswd parameter of password.cgi. The issue allows an attacker to execute arbitrary OS commands via a crafted request. Public documentation consistently references Netgear R8500 v1.0.2.160 and the sysNewPassw...

CVE-2024-52022

The CVE-2024-52022 issue affects Netgear R8500 (1.0.2.160), XR300 (1.0.3.78), R7000P (1.3.3.154), and R6400 v2 (1.0.4.128). It is a command-injection in the wlg_adv.cgi component exploitable via the apmode_gateway parameter, enabling an attacker to execute arbitrary OS commands through a crafted ...

CVE-2024-51008

The CVE-2024-51008 issue affects Netgear XR300 (firmware v1.0.3.78) due to a command injection in the wiz_dyn.cgi endpoint, specifically in the system_name parameter. The underlying flaw allows an attacker to craft a request that executes arbitrary OS commands on the device, yielding a high-sever...

CVE-2024-51015

Netgear R7000P (v1.3.3.154) is affected by CVE-2024-51015 through a command-injection in the operation_mode.cgi endpoint via the device_name2 parameter. The underlying issue, as documented across multiple sources, enables an attacker to execute arbitrary OS commands by sending a crafted request, ...

CVE-2024-52019

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at geniefix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51008

Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the systemname parameter at wizdyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51009

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wangateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-51023

D-Link DIR823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-50999

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

CVE-2024-10653

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server...

CVE-2024-10653 CHANGING Information Technology IDExpert - OS Command Injection

IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server...

CVE-2024-10653

CVE-2024-10653 affects CHANGING Information Technology IDExpert. The root cause is improper validation of a parameter in the administrator interface, enabling remote attackers with administrative privileges to inject and execute OS commands on the server. Affected versions include IDExpert up to ...

CVE-2024-8934

A local user with administrative access rights can enter specialy crafted values for settings at the user interface UI of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed...

CVE-2024-8934 Beckhoff: Local command injection via TwinCAT Package Manager

A local user with administrative access rights can enter specialy crafted values for settings at the user interface UI of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed...