163 matches found
CVE-2021-41383
setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...
CVE-2021-41383
setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...
Netgear NETGEAR R6020 命令注入漏洞
The NETGEAR R6020 is a router from Netgear, Inc. NETGEAR R6020 is vulnerable to a command injection vulnerability in version 1.0.0.48, which stems from a lack of validation and filtering in the ntpserver field of setup.cgi. An attacker with administrator status can use this vulnerability to injec...
CVE-2021-41383: Improper Neutralization of Special Elements used in a Command
setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntpserver field...
PT-2021-4801
Name of the Vulnerable Software and Affected Versions NETGEAR R6020 version 1.0.0.48 Description The issue is related to the lack of input validation, allowing an attacker to execute arbitrary shell commands via shell metacharacters in the ntp server field. This can be done by exploiting the...
NETGEAR WAC104身份验证绕过漏洞(CVE-2021-35973)
Summary: Affected Model: NETGEAR WAC104 Dual Band 802.11ac Wireless Access Point Firmware Version: V1.0.4.13 from 2020-09-14 NETGEAR WAC104 Access Point has multiple vulnerabilities which - chained together - allow an attacker in LAN to both change device admin's password, and gain root shell on...
CVE-2021-33514
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTPUSERAGENT;' with an OS command in the User-Agent field. This affects GC108P before...
CVE-2021-33514
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTPUSERAGENT;' with an OS command in the User-Agent field. This affects GC108P before...
PT-2021-20172
Name of the Vulnerable Software and Affected Versions NETGEAR GC108P versions prior to 1.0.7.3 NETGEAR GC108PP versions prior to 1.0.7.3 NETGEAR GS108Tv3 versions prior to 7.0.6.3 NETGEAR GS110TPPv1 versions prior to 7.0.6.3 NETGEAR GS110TPv3 versions prior to 7.0.6.3 NETGEAR GS110TUPv1 versions...
CVE-2021-33514: Improper Neutralization of Special Elements used in an OS Command
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by setup.cgi?token=';$HTTPUSERAGENT;' with an OS command in the User-Agent field. This affects GC108P before...
CVE-2019-20488
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface setup.cgi are vulnerable to command injection, allowing remote attackers to execute arbitrary commands, as demonstrated by shell metacharacters in the sysDNSHost parameter...
CVE-2019-20486
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages setup.cgi and advindex.htm within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language...
PT-2020-10470
Name of the Vulnerable Software and Affected Versions NETGEAR WNR1000V4 version 1.1.0.54 Description An issue was discovered in the web management interface, specifically in the setup.cgi, where multiple actions are vulnerable to command injection. This allows remote attackers to execute arbitrar...
PT-2020-10469
Name of the Vulnerable Software and Affected Versions NETGEAR WNR1000V4 version 1.1.0.54 Description An issue was discovered in the WNR1000V4 web management console, where multiple actions are vulnerable to an unauthenticated GET request, which can be exploited directly or through CSRF, as...
CVE-2019-20488: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface setup.cgi are vulnerable to command injection, allowing remote attackers to execute arbitrary commands, as demonstrated by shell metacharacters in the sysDNSHost parameter...
CVE-2019-20486: Improper Neutralization of Input During Web Page Generation
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages setup.cgi and advindex.htm within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language...
CVE-2019-20489: Improper Authentication
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface setup.cgi has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FWremote.htm&todo=cfginit reque...
CVE-2019-20487: Cross-Site Request Forgery (CSRF)
An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request exploitable directly or through CSRF, as demonstrated by the setup.cgi?todo=savehtpaccount URI...
PT-2020-10468
Name of the Vulnerable Software and Affected Versions NETGEAR WNR1000V4 version 1.1.0.54 Description An issue was discovered where multiple pages within the web management console, specifically setup.cgi and adv index.htm, are vulnerable to stored XSS. This is demonstrated by the configuration of...