CVE-2023-27850

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to access arbitrary files on the device...

CVE-2023-27853

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device...

CVE-2023-1205

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly implemented CSRF protections...

CVE-2021-23147

Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication...

CVE-2021-27253

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handli...

CVE-2021-45732

Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools,...

CVE-2021-20174

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be transmitted in...

CVE-2021-20175

Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface port 5000 is sent via HTTP, which causes potentially sensitive information such as usernames and passwords to be...

CVE-2021-20173

Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values...

CVE-2019-12513

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received, the device will generate a log entry containing the malicious...

CVE-2019-14526

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entire...

CVE-2019-12512

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs, found at Advanc...

CVE-2019-14527

An issue was discovered on NETGEAR Nighthawk M1 MR1100 devices before 12.06.03. System commands can be executed, via the web interface, after authentication...

The vulnerability of Nighthawk WiFi 6 Router (RAX30)’s microprogramming software, related to authentication procedures that allow attackers to execute arbitrary codes,

The vulnerability of Nighthawk WiFi 6 Router RAX30’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...

The vulnerability of the microprogramming software of the Nighthawk WiFi 6 Router (RAX30) allows a hacker to execute arbitrary code.

The vulnerability of the finddil function in the microprogramming software for Nighthawk WiFi 6 Routers RAX30 is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with root privileges...

The vulnerability of the Nighthawk WiFi 6 Router (RAX30)’s microprogramming software processor allows a hacker to execute arbitrary code.

The vulnerability of the Nighthawk WiFi 6 Router RAX30 microprogramming system software processor is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the CGI microprogramming interface of the Nighthawk WiFi 6 Router (RAX30) allows a hacker to execute arbitrary code.

The vulnerability of the CGI microprogramming interface of the Nighthawk WiFi 6 Router RAX30 lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the file-sharing mechanism of Nighthawk WiFi 6 Router (RAX30) allows a hacker to increase their privileges.

The vulnerability of the file-sharing mechanism of the Nighthawk WiFi 6 Router RAX30 software lies in the deficiencies of its authentication process. Exploiting this vulnerability allows a malicious actor to gain increased privileges remotely...

The vulnerability of the File Sharing component in the Nighthawk WiFi 6 Router (RAX30) microprogramming software allows a hacker to gain access to arbitrary files.

The vulnerability of the File Sharing component in the Nighthawk WiFi 6 Router RAX30 microprogramming software lies in insufficient access control. Exploiting this vulnerability can allow a remote attacker to gain access to arbitrary files...

The vulnerability of the SOAP service of the Nighthawk WiFi 6 Router (RAX30) software allows a hacker to execute arbitrary code.

The vulnerability of the SOAP service in the Nighthawk WiFi 6 Router RAX30 microprogramming system lies in the use of uncontrolled format strings. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...