CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-26931
https://notcve.org/view.php?id=CVE-2020-26931
09 Oct 2020 — Certain NETGEAR devices are affected by disclosure of sensitive information. This affects WC7500 before 6.5.5.24, WC7600 before 6.5.5.24, WC7600v2 before 6.5.5.24, and WC9500 before 6.5.5.24. Determinados dispositivos NETGEAR, están afectados por una divulgación de información confidencial. Esto afecta a WC7500 versiones anteriores a 6.5.5.24, WC7600 versiones anteriores a 6.5.5.24, WC7600v2 versiones anteriores a 6.5.5.24 y WC9500 versiones anteriores a 6.5.5.24 • https://kb.netgear.com/000062321/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Wireless-Controllers-PSV-2020-0268 •
CVSS: 6.5EPSS: 0%CPEs: 22EXPL: 0CVE-2020-17409 – NETGEAR Multiple Routers mini_httpd Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2020-17409
15 Sep 2020 — This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020, JNR3210, and WNR2020 routers with firmware 1.0.66. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose ... • https://kb.netgear.com/000062304/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2020-0258 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2020-25067
https://notcve.org/view.php?id=CVE-2020-25067
01 Sep 2020 — NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker. Los dispositivos NETGEAR R8300 versiones anteriores a 1.0.2.134, están afectados por una inyección de comandos por parte de un atacante no autenticado • https://kb.netgear.com/000062158/Security-Advisory-for-Pre-Authentication-Command-Injection-on-R8300-PSV-2020-0211 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-5621
https://notcve.org/view.php?id=CVE-2020-5621
28 Aug 2020 — Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firmware version 5.4.2.30 and earlier) allow remote attackers to hijack the authentication of administrators and alter the settings of the device via unspecified vectors. Una vulnerabilidad de tipo Cross-site request forgery (CSRF) en concentradores de conmutación NETGEAR (GS716Tv2 versiones de Firmware 5.4.2.30 y anteriores, y GS724Tv3 versiones de Firmware 5.4.2.30 y ante... • http://jvn.jp/en/jp/JVN29903998/index.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15634 – NETGEAR R6700 httpd strtblupgrade Format String Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-15634
04 Aug 2020 — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the web server. • https://kb.netgear.com/000062126/Security-Advisory-for-Pre-Authentication-Command-Injection-on-R6700v3-PSV-2020-0189 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 0CVE-2020-15636 – NETGEAR Multiple Routers check_ra Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-15636
04 Aug 2020 — This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R6400, R6700, R7000, R7850, R7900, R8000, RS400, and XR300 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the check_ra service. A crafted raePolicyVersion in a RAE_Policy.json file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context o... • https://kb.netgear.com/000062128/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-R6700v3-PSV-2020-0224 • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15635 – NETGEAR R6700 acsd Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-15635
04 Aug 2020 — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the acsd service, which listens on TCP port 5916 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this ... • https://kb.netgear.com/000062127/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-R6700v3-PSV-2020-0202 • CWE-121: Stack-based Buffer Overflow •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15417
https://notcve.org/view.php?id=CVE-2020-15417
28 Jul 2020 — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted gui_region in a string table file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. • https://www.zerodayinitiative.com/advisories/ZDI-20-713 • CWE-121: Stack-based Buffer Overflow •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2020-15416
https://notcve.org/view.php?id=CVE-2020-15416
28 Jul 2020 — This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in... • https://github.com/k3vinlusec/R7000_httpd_BOF_CVE-2020-15416 • CWE-121: Stack-based Buffer Overflow •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10930
https://notcve.org/view.php?id=CVE-2020-10930
28 Jul 2020 — This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from the lack of proper routing of URLs. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. • https://www.zerodayinitiative.com/advisories/ZDI-20-711 • CWE-284: Improper Access Control •