EUVD-2021-7631

Malicious code in bioql PyPI...

CVE-2021-23147

Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication...

CVE-2021-45732

Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools,...

CVE-2021-20173

Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values...

CVE-2021-38520

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52, R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, and R7000P before 1.3.2.124...

CVE-2020-15417

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted...

CVE-2017-18701

Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34...

CVE-2020-10927

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue...

CVE-2020-10928

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue...

CVE-2020-15416

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.8410.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by...

The vulnerability of NETGEAR’s microprogrammed router products such as D6220, D8500, R6700, and R6900 lies in the lack of measures to sanitize input data. This allows attackers to exploit their privileges and execute arbitrary commands.

The vulnerability of NETGEAR’s microprogrammed router models D6220, D8500, R6700, and R6900 lies in the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to enhance their privileges and execute arbitrary commands...

CVE-2023-33533

Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2.26 are vulnerable to Command Injection. If an attacker gains web management privileges, they can inject commands into the post request...

Command injection

Netgear D6220 with Firmware Version 1.0.0.80, D8500 with Firmware Version 1.0.3.60, R6700 with Firmware Version 1.0.2.26, and R6900 with Firmware Version 1.0.2.26 are vulnerable to Command Injection. If an attacker gains web management privileges, they can inject commands into the post request...

Netgear Router 命令注入漏洞

NETGEAR is a router from the American company NETGEAR. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in Netgear Router that stems from the presence of a command injection vulnerability. An attacker can exploit this...

CVE-2023-33533

CVE-2023-33533 affects Netgear D6220 (1.0.0.80), D8500 (1.0.3.60), R6700 (1.0.2.26), and R6900 (1.0.2.26). The root cause is lack of input data sanitization in the firmware’s web management post parameters, enabling command injection. If an attacker has web management privileges, they can inject ...

PT-2023-3101 · NetGear · Netgear R6700 +3

Name of the Vulnerable Software and Affected Versions: Netgear D6220 version 1.0.0.80 Netgear D8500 version 1.0.3.60 Netgear R6700 version 1.0.2.26 Netgear R6900 version 1.0.2.26 Description: The issue is related to the lack of input data sanitization in the firmware of Netgear routers. This allo...

CVE-2023-30280

CVE-2023-30280 affects Netgear routers: R6900 v1.0.2.26, R6700v3 v1.0.4.128, and R6700 v1.0.0.26. The root cause is a lack of bounds checking in the handling of the getInputData parameter on the fwSchedule.cgi page, allowing a remote attacker to execute arbitrary code and cause a denial of servic...

PT-2023-2752 · NetGear · Netgear R6700 +2

Name of the Vulnerable Software and Affected Versions: Netgear R6900 version 1.0.2.26 Netgear R6700v3 version 1.0.4.128 Netgear R6700 version 1.0.0.26 Description: A Buffer Overflow issue allows a remote attacker to execute arbitrary code and cause a denial of service via the getInputData paramet...

Netgear Nighthawk R6700 Encryption Issue Vulnerability (CNVD-2022-02653)

Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the product's failure to use the soap secure communication method. An attacker could obtain sensitive information from HTTP requests through this...

Netgear Nighthawk R6700 License Issue Vulnerability

The Netgear Nighthawk R6700 is a wireless router from Netgear USA. An authorization issue vulnerability exists in the Netgear Nighthawk R6700 that stems from the product's lack of adequate protection for UART console access. The vulnerability can be exploited by an attacker to execute commands as...