Page 11 of 63 results (0.007 seconds)

CVSS: 8.8EPSS: 0%CPEs: 88EXPL: 0

CVE-2021-34991 – NETGEAR R6400v2 UPnP uuid Stack-based Buffer Overflow Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2021-34991

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. When parsing the uuid request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://kb.netgear.com/000064361/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0168 https://www.zerodayinitiative.com/advisories/ZDI-21-1303 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •

CVSS: 7.2EPSS: 0%CPEs: 12EXPL: 0

CVE-2021-38520

https://notcve.org/view.php?id=CVE-2021-38520

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.52, R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, and R7000P before 1.3.2.124. Determinados dispositivos NETGEAR están afectados por una inyección de comandos por un usuario autenticado. Esto afecta a R6400 versiones anteriores a 1.0.1.52, R6400v2 versiones anteriores a 1.0.4.84, R6700v3 versiones anteriores a 1.0.4.84, R6700v2 versiones anteriores a 1.2.0.62, R6900v2 versiones anteriores a 1.2.0.62 y R7000P versiones anteriores a 1.3.2.124 • https://kb.netgear.com/000063763/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0565 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 10.0EPSS: 0%CPEs: 12EXPL: 0

CVE-2021-38528

https://notcve.org/view.php?id=CVE-2021-38528

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6900P before 1.3.2.132, R7000P before 1.3.2.132, R7100LG before 1.0.0.64, WNDR3400v3 before 1.0.1.38, and XR300 before 1.0.3.56. Determinados dispositivos NETGEAR están afectados por una inyección de comandos por un atacante no autenticado. Esto afecta a D8500 versiones anteriores a 1.0.3.58, R6900P versiones anteriores a 1.3.2.132, R7000P versiones anteriores a 1.3.2.132, R7100LG versiones anteriores a 1.0.0.64, WNDR3400v3 versiones anteriores a 1.0.1.38 y XR300 versiones anteriores a 1.0.3.56 • https://kb.netgear.com/000063781/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Gateways-and-Routers-PSV-2020-0297 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 8.8EPSS: 0%CPEs: 26EXPL: 0

CVE-2021-38539

https://notcve.org/view.php?id=CVE-2021-38539

Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before 1.0.2.66, R6900 before 1.0.2.4, R6900P before 1.3.2.126, R7000 before 1.0.9.42, R7000P before 1.3.2.126, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.10, R8300 before 1.0.2.130, and R8500 before 1.0.2.130. Determinados dispositivos NETGEAR están afectados por una escalada de privilegios. Esto afecta a D8500 versiones anteriores a 1.0.3.44, R6400v2 versiones anteriores a 1.0.2.66, R6700 versiones anteriores a 1.0.2.6, R6700v3 versiones anteriores a 1.0.2.66, R6900 versiones anteriores a 1.0.2.4, R6900P versiones anteriores a 1.3.2.126, R7000 versiones anteriores a 1.0.9.42, R7100LG versiones anteriores a 1.3.2.126, R7300DG versiones anteriores a 1.0.0.50, R7000P versiones anteriores a 1.3.2.126. 0.9.42, R7000P versiones anteriores a 1.3.2.126, R7100LG versiones anteriores a 1.0.0.50, R7300DST versiones anteriores a 1.0.0.70, R7900 versiones anteriores a 1.0.3.10, R8300 versiones anteriores a 1.0.2.130 y R8500 versiones anteriores a 1.0.2.130 • https://kb.netgear.com/000063760/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-and-Gateways-PSV-2018-0385 •

CVSS: 8.1EPSS: 0%CPEs: 32EXPL: 0

CVE-2021-29080

https://notcve.org/view.php?id=CVE-2021-29080

Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR854 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 before 2.5.0.10, R7000 before 1.0.11.116, R6900P before 1.3.2.126, R7900 before 1.0.4.38, R7960P before 1.4.1.66, R8000 before 1.0.4.66, R7900P before 1.4.1.66, R8000P before 1.4.1.66, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, and R7000P before 1.3.2.126. Determinados dispositivos NETGEAR están afectados por un restablecimiento de contraseña por parte de un atacante no autenticado. Esto afecta al RBK852 versiones anteriores a 3.2.10.11, al RBK853 versiones anteriores a 3.2.10.11, al RBR854 versiones anteriores a 3.2.10.11, al RBR850 versiones anteriores a 3.2.10.11, al RBS850 versiones anteriores a 3.2.10.11, al CBR40 versiones anteriores a 2.5.0.10, al R7000 versiones anteriores a 1.0.11.116, al R6900P versiones anteriores a 1. 3.2.126, R7900 versiones anteriores a 1.0.4.38, R7960P versiones anteriores a 1.4.1.66, R8000 versiones anteriores a 1.0.4.66, R7900P versiones anteriores a 1.4.1.66, R8000P versiones anteriores a 1.4.1.66, RAX75 versiones anteriores a 1.0.3.102, RAX80 versiones anteriores a 1.0.3.102 y R7000P versiones anteriores a 1.3.2.126 • https://kb.netgear.com/000063007/Security-Advisory-for-Pre-authentication-Password-Reset-on-Some-Routers-and-WiFi-Systems-PSV-2019-0150 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •