Command injection

Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values...

Default configuration

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface port 5000 is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be...

Default configuration

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be transmitted in...

Hardcoded credentials

Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools,...

CVE-2021-20174

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be transmitted in...

CVE-2021-20175

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface port 5000 is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be...

CVE-2021-20175

Netgear Nighthawk R6700 (firmware 1.0.4.120) exposes its SOAP interface on port 5000 and communicates over HTTP by default, causing credentials and other sensitive data to be transmitted in cleartext. Root cause: lack of secure transport for SOAP API calls. Impact: potential exposure of usernames...

CVE-2021-20174

The CVE-2021-20174 entry concerns Netgear Nighthawk R6700 (firmware 1.0.4.120). The root cause is that web-interface traffic is not secured, with all communications over HTTP by default. As described in multiple connected sources, this can expose sensitive information (e.g., usernames and passwor...

CVE-2021-20173

Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values...

CVE-2021-20173

Netgear Nighthawk R6700 router (firmware 1.0.4.120) is affected by a command-injection vulnerability in the update functionality exposed via the SOAP interface. A system update check can be triggered with preconfigured values to inject commands. Root cause: insecure handling in the update/SOAP pa...

CVE-2021-45077

CVE-2021-45077 affects Netgear Nighthawk R6700 (firmware 1.0.4.120). The device stores usernames and passwords for its services in plaintext in the primary configuration file; CNVD-2022-02652 notes an encryption vulnerability due to failure to encrypt account information, with plaintext credentia...

CVE-2021-45732

Netgear Nighthawk R6700, firmware 1.0.4.120, is affected by a vulnerability where a hardcoded credential can be exploited to extract the device configuration. By using public tools to obtain the backup configuration, an attacker can repackage and restore it to alter settings not intended to be ma...

CVE-2021-23147

The CVE concerns Netgear Nighthawk R6700 router (v1.0.4.120). The root cause is insufficient protections for the UART console, enabling a physically proximate attacker with serial access to execute commands as root without authentication. Implications include full device compromise and potential ...

CVE-2021-45732

Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools,...

Netgear Nighthawk R6700 授权问题漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear USA. An authorization issue vulnerability exists in the Netgear Nighthawk R6700 that stems from the product's lack of adequate protection for UART console access. The vulnerability can be exploited by an attacker to execute commands as...

Netgear Nighthawk R6700操作系统命令注入漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. A command injection vulnerability exists in the Netgear Nighthawk R6700, which stems from the fact that the product supports update checking via the soap interface and can be injected with a pre-set value. No details of the...

Netgear Nighthawk R6700 加密问题漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the product's failure to encrypt account information. An attacker could obtain plaintext account information in the Zhu configuration file throug...

Netgear Nighthawk R6700 信任管理问题漏洞

The Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the fact that the product does not effectively encrypt configuration files. An attacker could modify the backup configuration by extracting the...

Netgear Nighthawk R6700 加密问题漏洞

Netgear Nighthawk R6700 is a wireless router from Netgear, Inc. An encryption vulnerability exists in the Netgear Nighthawk R6700, which stems from the product's failure to use the soap secure communication method. An attacker could obtain sensitive information from HTTP requests through this...

Netgear Nighthawk R6700 信息泄露漏洞

An information disclosure vulnerability exists in the Netgear Nighthawk R6700, a wireless router from Netgear, which stems from the product's failure to encrypt HTTP requests. An attacker could gain access to sensitive information through this vulnerability...