CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2024-12847 – NETGEAR DGN setup.cgi OS Command Injection
https://notcve.org/view.php?id=CVE-2024-12847
10 Jan 2025 — NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been exploited in the wild since at least 2017. • https://seclists.org/bugtraq/2013/Jun/8 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-12988 – Netgear R6900P/R7000P HTTP Header sub_16C4C buffer overflow
https://notcve.org/view.php?id=CVE-2024-12988
27 Dec 2024 — A vulnerability has been found in Netgear R6900P and R7000P 1.3.3.154 and classified as critical. Affected by this vulnerability is the function sub_16C4C of the component HTTP Header Handler. The manipulation of the argument Host leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/physicszq/Routers/tree/main/Netgear/1.3.3.154 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 1CVE-2024-12147 – Netgear R6900 HTTP Header upgrade_check.cgi buffer overflow
https://notcve.org/view.php?id=CVE-2024-12147
04 Dec 2024 — A vulnerability was found in Netgear R6900 1.0.1.26_1.0.20. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file upgrade_check.cgi of the component HTTP Header Handler. The manipulation of the argument Content-Length leads to buffer overflow. The attack can be launched remotely. • https://github.com/upload000/Hub/blob/main/IOT/Netgear_R6900.md • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50993
https://notcve.org/view.php?id=CVE-2024-50993
05 Nov 2024 — Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Se descubrió que Netgear R8500 v1.0.2.160 contiene una vulnerabilidad de inyección de comandos en el parámetro sysNewPasswd en admin_account.cgi. Esta vulnerabilidad permite a los atacantes ejecutar comandos arbitrarios del sistema operativo mediante una solicitud manipulada. • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_39/39.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50994
https://notcve.org/view.php?id=CVE-2024-50994
05 Nov 2024 — Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6_fix.cgi via the ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160 contiene múltiples vulnerabilidades de desbordamiento de pila en el componente ipv6_fix.cgi a través de los parámetros ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_36/36.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50995
https://notcve.org/view.php?id=CVE-2024-50995
05 Nov 2024 — Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160 contenía un desbordamiento de pila a través del parámetro share_name en usb_remote_smb_conf.cgi. Esta vulnerabilidad permite a los atacantes provocar una denegación de servicio (DoS) a través de una solicitud POST manipulada. • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_40/40.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2024-50996
https://notcve.org/view.php?id=CVE-2024-50996
05 Nov 2024 — Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpa_server parameter at genie_bpa.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contenían un desbordamiento de pila a través del parámetro bpa_server en genie_bpa.cgi. Esta vulnerabilidad permite a los atacantes provoc... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_37/37.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 5EXPL: 0CVE-2024-50997
https://notcve.org/view.php?id=CVE-2024-50997
05 Nov 2024 — Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contenían un desbordamiento de pila a través del parámetro pptp_user_ip en pptp.cgi. Esta vulnerabilidad permite a los atacantes provocar una... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50998
https://notcve.org/view.php?id=CVE-2024-50998
05 Nov 2024 — Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpn_service_port and openvpn_service_port_tun parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. Se descubrió que Netgear R8500 v1.0.2.160 contiene múltiples vulnerabilidades de desbordamiento de pila en el componente openvpn.cgi a través de los parámetros openvpn_service_port y openvpn_service_port_tun. Estas vulner... • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_44/44.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50999
https://notcve.org/view.php?id=CVE-2024-50999
05 Nov 2024 — Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. Se descubrió que Netgear R8500 v1.0.2.160 contiene una vulnerabilidad de inyección de comandos en el parámetro sysNewPasswd en password.cgi. Esta vulnerabilidad permite a los atacantes ejecutar comandos arbitrarios del sistema operativo mediante una solicitud manipulada. • https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_38/38.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •