Netgear NETGEAR Trust Management Issues Vulnerabilities

Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in the NETGEAR Nighthawk R7800, which can be exploited by an attacker to execute arbitrary code in the root...

(Pwn2Own) NETGEAR Nighthawk R7800 ready-genie-cloud Insecure Download of Critical Component Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Authentication is not required to exploit this vulnerability The specific flaw exists within handling of firmware updates. The issue results from a fallback to a...

Command Injection Vulnerability in Multiple Netgear Products

Netgear NETGEAR R8900 and others are products of Netgear, Inc.NETGEAR R8900 is a wireless router.NETGEAR R9000 is a wireless router.NETGEAR R7800 is a wireless router. A command injection vulnerability exists in a number of NETGEAR routers, which arises from a network system or product not proper...

Multiple Netgear Products Licensing Issues Vulnerabilities

Netgear NETGEAR WNR2020 and others are products of Netgear, Inc.NETGEAR WNR2020 is a wireless router.NETGEAR R6220 is a wireless router.NETGEAR R6700v2 is a wireless router. An authorization issue vulnerability exists in multiple NETGEAR routers that stems from a lack of authentication measures o...

NETGEAR Multiple Routers mini_httpd Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this...

CVE-2020-28041

The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.6410.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs...

CVE-2020-28041

The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.6410.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs...

Design/Logic Flaw

The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.6410.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs...

CVE-2020-28041

The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.6410.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs...

PT-2020-16904 · NetGear · Netgear Nighthawk R7000

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk R7000 version 1.0.9.64 10.2.64 Description: The issue allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a...

Netgear Nighthawk R6700 Router Heap Overflow

A heap overflow vulnerability exists in Netgear Nighthawk R6700 Router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

This Week in Security News: 10,000 Users Affected by Leak from Misconfigured AWS Cloud Storage and Massive U.S. Property and Demographic Database Exposes 200 Million Records

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how the data of train commuters in the U.K. who were using the free Wi-Fi in Network Rail-managed stations was unintentionally...

Critical Netgear Bug Impacts Flagship Nighthawk Router

Netgear is warning users of a critical remote code execution bug that could allow an unauthenticated attacker to take control of its Wireless AC Router Nighthawk R7800 hardware running firmware versions prior to 1.0.2.68. The warnings, posted Tuesday, also include two high-severity bugs impacting...

NETGEAR Nighthawk X10-R9000 Cross-Site Scripting Vulnerability

The NETGEAR Nighthawk X10-R9000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in the NETGEAR Nighthawk X10-R9000 using firmware prior to version 1.0.4.24. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker c...

NETGEAR Nighthawk X10-R9000 Command Injection Vulnerability

The NETGEAR Nighthawk X10-R9000 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR Nighthawk X10-R9000 using firmware prior to version 1.0.4.26. The vulnerability stems from a network system or product not properly filtering specific elements of externally...

NETGEAR Nighthawk X10-R9000 Cross-Site Scripting Vulnerability (CNVD-2020-13506)

The NETGEAR Nighthawk X10-R9000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in the NETGEAR Nighthawk X10-R9000 using firmware prior to version 1.0.4.24. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker c...

NETGEAR Nighthawk X10-R9000 Authentication Bypass Vulnerability

The NETGEAR Nighthawk X10-R9000 is a wireless router from NETGEAR. A security vulnerability exists in the NETGEAR Nighthawk X10-R9000 using firmware versions prior to 1.0.4.26. An attacker could exploit the vulnerability to bypass authentication...

CVE-2019-12510

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API "/soap/serversa" by supplying a malicious X-Forwarded-For header of the device's LAN IP address 192.168.1.1 in every request. As a result, an attacker may...

CVE-2019-12513

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious...

CVE-2019-12512

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanc...