CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30569
https://notcve.org/view.php?id=CVE-2024-30569
03 Apr 2024 — An information leak in currentsetting.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required. Una fuga de información en currentsetting.htm de Netgear R6850 v1.1.0.88 permite a los atacantes obtener información confidencial sin necesidad de autenticación. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88currentsetting.htm%EF%BC%89.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30570
https://notcve.org/view.php?id=CVE-2024-30570
03 Apr 2024 — An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required. Una fuga de información en debuginfo.htm de Netgear R6850 v1.1.0.88 permite a los atacantes obtener información confidencial sin necesidad de autenticación. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88debuginfo.htm%EF%BC%89.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30572
https://notcve.org/view.php?id=CVE-2024-30572
03 Apr 2024 — Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp_server parameter. Se descubrió que Netgear R6850 1.1.0.88 contiene una vulnerabilidad de inyección de comandos a través del parámetro ntp_server. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Netgear-R6850%20V1.1.0.88%20Command%20Injection%28ntp_server%29.md •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50677
https://notcve.org/view.php?id=CVE-2023-50677
14 Mar 2024 — An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component. Un problema en NETGEAR-DGND4000 v.1.1.00.15_1.00.15 permite a un atacante remoto escalar privilegios a través del parámetro next_file al componente /setup.cgi. • https://gist.github.com/DMIND-NLL/b61b8d8d20271adf60fc717b3b48faff • CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-28339
https://notcve.org/view.php?id=CVE-2024-28339
12 Mar 2024 — An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required. Una fuga de información en el componente debuginfo.htm de Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28 y Netgear CBK43 2.5.0.28 permite a los atacantes obtener información confidencial sin necesidad de autenticación. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88debuginfo.htm%EF%BC%89.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-28340
https://notcve.org/view.php?id=CVE-2024-28340
12 Mar 2024 — An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows attackers to obtain sensitive information without any authentication required. Una fuga de información en el componente currentsetting.htm de Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28 y Netgear CBK43 2.5.0.28 permite a los atacantes obtener información confidencial sin necesidad de autenticación. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/Netgear%20CBR40%5CCBK40%5CCBK43/Info%20Leak%20in%20Netgear-CBR40%E3%80%81CBK40%E3%80%81CBK43%20Router%EF%BC%88currentsetting.htm%EF%BC%89.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48725
https://notcve.org/view.php?id=CVE-2023-48725
07 Mar 2024 — A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7.78. A specially crafted HTTP request can lead to code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Existe una vulnerabilidad de desbordamiento de búfer en la región stack de la memoria en la funcionalidad getblockschedule() de JSON Parsing de Netgear RAX30 1.0.11.96 y 1.0.7.78. Una solicitud HTTP especialmente manipulada ... • https://kb.netgear.com/000066037/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-the-RAX30-PSV-2023-0160 • CWE-121: Stack-based Buffer Overflow •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-1431 – Netgear R7000 Web Management Interface debuginfo.htm information disclosure
https://notcve.org/view.php?id=CVE-2024-1431
11 Feb 2024 — A vulnerability was found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this issue is some unknown functionality of the file /debuginfo.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-253382 is the identifier assigned to this vulnerability. • https://github.com/leetsun/Hints/tree/main/R7000/2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2024-1430 – Netgear R7000 Web Management Interface currentsetting.htm information disclosure
https://notcve.org/view.php?id=CVE-2024-1430
11 Feb 2024 — A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /currentsetting.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. The identifier VDB-253381 was assigned to this vulnerability. • https://github.com/leetsun/Hints/tree/main/R7000/1 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50231 – NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2023-50231
20 Dec 2023 — NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the saveNodeLabel method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. • https://kb.netgear.com/000065901/Security-Advisory-for-Stored-Cross-Site-Scripting-on-the-NMS300-PSV-2023-0106 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •