CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34947 – NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-34947
NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the soap_block_table file. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of root. . • https://kb.netgear.com/000064044/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2021-0129 https://www.zerodayinitiative.com/advisories/ZDI-21-1116 • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 0%CPEs: 22EXPL: 1CVE-2021-40847
https://notcve.org/view.php?id=CVE-2021-40847
The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. • https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2021-41383
https://notcve.org/view.php?id=CVE-2021-41383
setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server field. el archivo setup.cgi en los dispositivos NETGEAR R6020 versión 1.0.0.48, permite a un administrador ejecutar comandos de shell arbitrarios por medio de metacaracteres de shell en el campo ntp_server • https://j-o-e-l-s.github.io/2021/09/15/Hacking-The-Netgear-R6020.html • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 40EXPL: 1CVE-2021-41314
https://notcve.org/view.php?id=CVE-2021-41314
Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2. Determinados smart switches de NETGEAR están afectados por una inyección de \n en el campo de la contraseña de la Interfaz de Usuario Web, que - debido a varios aspectos defectuosos del esquema de autenticación - permite al atacante crear (o sobrescribir) un archivo con contenido específico (por ejemplo, la cadena "2"). Esto conlleva a que un atacante no autenticado diseñe una sesión de administrador y, por lo tanto, alcance todos los privilegios de administrador de la interfaz web. • https://gynvael.coldwind.pl/?id=742 https://kb.netgear.com/000063978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.8EPSS: 0%CPEs: 40EXPL: 1CVE-2021-40867
https://notcve.org/view.php?id=CVE-2021-40867
Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an admin in the process of logging in (e.g., behind the same NAT device, or already in possession of a foothold on an admin's machine). This occurs because the multi-step HTTP authentication process is effectively tied only to the source IP address. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2. Determinados smart switches de NETGEAR están afectados por una vulnerabilidad de secuestro de autenticación por parte de un atacante no autenticado que usa la misma dirección IP de origen que un administrador en el proceso de inicio de sesión (por ejemplo, detrás del mismo dispositivo NAT, o ya en posesión de un punto de apoyo en la máquina de un administrador). Esto ocurre porque el proceso de autenticación HTTP de varios pasos está efectivamente ligado sólo a la dirección IP de origen. • https://gynvael.coldwind.pl/?id=741 https://kb.netgear.com/000063978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145 • CWE-290: Authentication Bypass by Spoofing •