CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20175
https://notcve.org/view.php?id=CVE-2021-20175
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface (port 5000) is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext Netgear Nighthawk R6700 versión 1.0.4.120, no usa métodos de comunicación seguros para la interfaz SOAP. De forma predeterminada, toda la comunicación hacia/desde la interfaz SOAP del dispositi... • https://www.tenable.com/security/research/tra-2021-57 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.8EPSS: 11%CPEs: 2EXPL: 1CVE-2021-20173
https://notcve.org/view.php?id=CVE-2021-20173
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface, the device is susceptible to command injection via preconfigured values. Netgear Nighthawk R6700 versión 1.0.4.120, contiene una vulnerabilidad de inyección de comandos en la funcionalidad update del dispositivo. Al desencadenar una comprobación de actualización del sistema por medio de la interfaz SOAP, el dispositivo es susc... • https://www.tenable.com/security/research/tra-2021-57 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-45077
https://notcve.org/view.php?id=CVE-2021-45077
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device. Netgear Nighthawk R6700 versión 1.0.4.120, almacena información confidencial en texto plano. Todos los nombres de usuario y las contraseñas de los servicios asociados al dispositivo se almacenan en texto plano en el dis... • https://www.tenable.com/security/research/tra-2021-57 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-45732
https://notcve.org/view.php?id=CVE-2021-45732
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools, a user can reconfigure settings not intended to be manipulated, repackage the configuration, and restore a backup causing these settings to be changed. Netgear Nighthawk R6700 versión 1.0.4.120, usa una credencial ... • https://www.tenable.com/security/research/tra-2021-57 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-23147
https://notcve.org/view.php?id=CVE-2021-23147
30 Dec 2021 — Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication. Netgear Nighthawk R6700 versión 1.0.4.120, no presenta suficientes protecciones para la consola UART. Un actor malicioso con acceso físico al dispositivo puede conectarse al puerto UART por medio de una conexión serie y ejecutar comando... • https://www.tenable.com/security/research/tra-2021-57 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 42EXPL: 0CVE-2021-45512
https://notcve.org/view.php?id=CVE-2021-45512
26 Dec 2021 — Certain NETGEAR devices are affected by weak cryptography. This affects D7000v2 before 1.0.0.62, D8500 before 1.0.3.50, EX3700 before 1.0.0.84, EX3800 before 1.0.0.84, EX6120 before 1.0.0.54, EX6130 before 1.0.0.36, EX7000 before 1.0.1.90, R6250 before 1.0.4.42, R6400v2 before 1.0.4.98, R6700v3 before 1.0.4.98, R6900P before 1.3.2.124, R7000 before 1.0.11.106, R7000P before 1.3.2.124, R7100LG before 1.0.0.56, R7900 before 1.0.4.26, R8000 before 1.0.4.58, R8300 before 1.0.2.134, R8500 before 1.0.2.134, RS400... • https://kb.netgear.com/000064117/Security-Advisory-for-Broken-Cryptography-on-Some-Routers-and-Extenders-PSV-2020-0134 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 8.8EPSS: 0%CPEs: 30EXPL: 0CVE-2021-45525
https://notcve.org/view.php?id=CVE-2021-45525
26 Dec 2021 — Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects EX7000 before 1.0.1.80, R6400 before 1.0.1.50, R6400v2 before 1.0.4.118, R6700 before 1.0.2.8, R6700v3 before 1.0.4.118, R6900 before 1.0.2.8, R6900P before 1.3.2.124, R7000 before 1.0.9.88, R7000P before 1.3.2.124, R7900 before 1.0.3.18, R7900P before 1.4.1.50, R8000 before 1.0.4.46, R8000P before 1.4.1.50, RAX80 before 1.0.1.56, and WNR3500Lv2 before 1.2.0.62. Determinados dispositivos NETGEAR están afectados ... • https://kb.netgear.com/000064052/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-and-Extenders-PSV-2018-0618 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.4EPSS: 0%CPEs: 54EXPL: 0CVE-2021-45549
https://notcve.org/view.php?id=CVE-2021-45549
26 Dec 2021 — Certain NETGEAR devices are affected by command injection by an authenticated user. This affects LAX20 before 1.1.6.28, MK62 before 1.1.6.122, MR60 before 1.1.6.122, MS60 before 1.1.6.122, R6400v2 before 1.0.4.118, R6700v3 before 1.0.4.118, R6900P before 1.3.3.140, R7000 before 1.0.11.116, R7000P before 1.3.3.140, R7850 before 1.0.5.68, R7900 before 1.0.4.38, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000 before 1.0.4.68, R8000P before 1.4.2.84, RAX15 before 1.0.3.96, RAX20 before 1.0.3.96, RAX200 be... • https://kb.netgear.com/000064513/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0517 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 60EXPL: 0CVE-2021-45550
https://notcve.org/view.php?id=CVE-2021-45550
26 Dec 2021 — Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.78, D6100 before 1.0.0.63, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7800 before 1.0.1.56, D8500 before 1.0.3.44, DGN2200Bv4 before 1.0.0.109, DGN2200v4 before 1.0.0.110, R6250 before 1.0.4.34, R6300v2 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before 1.0.2.66, R6900 before 1.0.2.4, R6900P before 1.3.1.64, R7000 be... • https://kb.netgear.com/000064049/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0376 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 0CVE-2021-45573
https://notcve.org/view.php?id=CVE-2021-45573
26 Dec 2021 — Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6260 before 1.1.0.76, R6800 before 1.2.0.62, R6700v2 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, AC2100 before 1.2.0.62, AC2400 before 1.2.0.62, and AC2600 before 1.2.0.62. Determinados dispositivos NETGEAR están afectados por un desbordamiento del búfer en la región stack de la memoria por parte de un atacante no autenticado. Esto afecta a R6260 versiones anteriores a 1.1... • https://kb.netgear.com/000064095/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0081 • CWE-787: Out-of-bounds Write •