CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-12988 – Netgear R6900P/R7000P HTTP Header sub_16C4C buffer overflow
https://notcve.org/view.php?id=CVE-2024-12988
27 Dec 2024 — A vulnerability has been found in Netgear R6900P and R7000P 1.3.3.154 and classified as critical. Affected by this vulnerability is the function sub_16C4C of the component HTTP Header Handler. The manipulation of the argument Host leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/physicszq/Routers/tree/main/Netgear/1.3.3.154 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-50996
https://notcve.org/view.php?id=CVE-2024-50996
05 Nov 2024 — Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpa_server parameter at genie_bpa.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contenían un desbordamiento de pila a través del parámetro bpa_server en genie_bpa.cgi. Esta vulnerabilidad permite a los atacantes provoc... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_37/37.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-50997
https://notcve.org/view.php?id=CVE-2024-50997
05 Nov 2024 — Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contenían un desbordamiento de pila a través del parámetro pptp_user_ip en pptp.cgi. Esta vulnerabilidad permite a los atacantes provocar una... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-51002
https://notcve.org/view.php?id=CVE-2024-51002
05 Nov 2024 — Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the l2tp_user_ip parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contenían un desbordamiento de pila a través del parámetro l2tp_user_ip en l2tp.cgi. Esta vulnerabilidad permite a los atacantes provocar una... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_42/42.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-51003
https://notcve.org/view.php?id=CVE-2024-51003
05 Nov 2024 — Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component ap_mode.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrieron múltiples vulnerabilidades de desbordamiento de pila en el componente ap_mode.cgi a través de los parámetros apmode_dns1_pri y apmode_dns1_sec en Netgear R8500 v1.0.2... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_49/49.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-51004
https://notcve.org/view.php?id=CVE-2024-51004
05 Nov 2024 — Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb_device.cgi via the cifs_user, read_access, and write_access parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrieron múltiples vulnerabilidades de desbordamiento de pila en Netgear R8500 v1.0.2.160 y R7000P v1.3.3.154 en el componente usb_device.cgi a través de los parámetros cifs_user, read_access y write_acces... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_51/51.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 1%CPEs: 4EXPL: 0CVE-2024-51010
https://notcve.org/view.php?id=CVE-2024-51010
05 Nov 2024 — Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Se descubrió que Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contienen una vulnerabilidad de inyección de comandos en el componente ap_mode.cgi a través del parámetro apmode... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-51011
https://notcve.org/view.php?id=CVE-2024-51011
05 Nov 2024 — Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contienen un desbordamiento de pila a través del parámetro pppoe_localip en pppoe.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegación de servicio (DoS) a t... • https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51013
https://notcve.org/view.php?id=CVE-2024-51013
05 Nov 2024 — Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the RADIUSAddr%d_wla parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R7000P v1.3.3.154 contenía un desbordamiento de pila a través del parámetro RADIUSAddr%d_wla en wireless.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegación de servicio (DoS) a través de una solicitud POST manipulada. • https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_64/64.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51015
https://notcve.org/view.php?id=CVE-2024-51015
05 Nov 2024 — Netgear R7000P v1.3.3.154 was discovered to contain a command injection vulnerability via the device_name2 parameter at operation_mode.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Se descubrió que Netgear R7000P v1.3.3.154 contiene una vulnerabilidad de inyección de comandos a través del parámetro device_name2 enoperation_mode.cgi. Esta vulnerabilidad permite a los atacantes ejecutar comandos arbitrarios del sistema operativo a través de una solicitud mani... • https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_62/62.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •