CVSS: 4.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-45676
https://notcve.org/view.php?id=CVE-2021-45676
26 Dec 2021 — Certain NETGEAR devices are affected by stored XSS. This affects RAX200 before 1.0.5.126, RAX20 before 1.0.2.82, RAX80 before 1.0.5.126, RAX15 before 1.0.2.82, and RAX75 before 1.0.5.126. Determinados dispositivos NETGEAR están afectados por un ataque de tipo XSS almacenado. Esto afecta a RAX200 versiones anteriores a 1.0.5.126, RAX20 versiones anteriores a 1.0.2.82, RAX80 versiones anteriores a 1.0.5.126, RAX15 versiones anteriores a 1.0.2.82 y RAX75 versiones anteriores a 1.0.5.126 • https://kb.netgear.com/000064462/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2020-0161 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-45677
https://notcve.org/view.php?id=CVE-2021-45677
26 Dec 2021 — Certain NETGEAR devices are affected by stored XSS. This affects GS108Tv2 before 5.4.2.36 and GS110TPv2 before 5.4.2.36. Determinados dispositivos NETGEAR están afectados por un ataque de tipo XSS almacenado. Esto afecta a GS108Tv2 versiones anteriores a 5.4.2.36 y GS110TPv2 versiones anteriores a 5.4.2.36 • https://kb.netgear.com/000064448/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Smart-Managed-Pro-Switches-PSV-2019-0191 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-45678
https://notcve.org/view.php?id=CVE-2021-45678
26 Dec 2021 — NETGEAR RAX200 devices before 1.0.5.132 are affected by insecure code. Los dispositivos NETGEAR RAX200 versiones anteriores a 1.0.5.132, están afectados por un código no seguro • https://kb.netgear.com/000064171/Security-Advisory-for-Updates-on-the-RAX200-PSV-2021-0192 •
CVSS: 8.4EPSS: 0%CPEs: 8EXPL: 0CVE-2021-45679
https://notcve.org/view.php?id=CVE-2021-45679
26 Dec 2021 — Certain NETGEAR devices are affected by privilege escalation. This affects R6900P before 1.3.3.140, R7000 before 1.0.11.126, R7000P before 1.3.3.140, and RS400 before 1.5.1.80. Determinados dispositivos NETGEAR están afectados por una escalada de privilegios. Esto afecta a R6900P versiones anteriores a 1.3.3.140, a R7000 versiones anteriores a 1.0.11.126, a R7000P versiones anteriores a 1.3.3.140 y a RS400 versiones anteriores a 1.5.1.80 • https://kb.netgear.com/000064528/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-PSV-2021-0043 •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-41449
https://notcve.org/view.php?id=CVE-2021-41449
09 Dec 2021 — A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote unauthenticated attacker to gain access to sensitive restricted information, such as forbidden files of the web application, via sending a specially crafted HTTP packet. Un ataque de salto de ruta en las interfaces web de los routers Netgear RAX35, RAX38 y RAX40 versiones anteriores a v1.0.4.102, permite a un atacante remoto no autenticado conseguir acceso a información confidencial restri... • http://netgear.com • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 88EXPL: 0CVE-2021-34991 – NETGEAR R6400v2 UPnP uuid Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-34991
11 Nov 2021 — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. When parsing the uuid request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerab... • https://kb.netgear.com/000064361/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products-PSV-2021-0168 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34982 – NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-34982
29 Oct 2021 — NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. When parsing the strings file, the process does not properly validate the length of user-supplied data prior to copying it to a ... • https://kb.netgear.com/000064313/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Extenders-Routers-and-DSL-Modem-Routers-PSV-2021-0159 • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-34977 – NETGEAR R7000 SOAP ParentalControl Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2021-34977
28 Oct 2021 — This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7000 1.0.11.116_10.2.100 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP requests. The issue results from the lack of proper authentication verification before performing a password reset. An attacker can leverage this vulnerability to reset the admin password. • https://kb.netgear.com/000064046/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-and-DSL-Modem-Routers-PSV-2021-0134 • CWE-287: Improper Authentication CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-34978 – NETGEAR R6260 setupwizard.cgi Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-34978
28 Oct 2021 — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. A crafted SOAP request can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://kb.netgear.com/000064258/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-DSL-Modem-Routers-and-Access-Points-PSV-2021-0151-and-PSV-2021-0170?article=000064258 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-34979 – NETGEAR R6260 mini_httpd Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-34979
28 Oct 2021 — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://kb.netgear.com/000064261/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-PSV-2021-0152?article=000064261 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •