98 results (0.006 seconds)

CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi. Los dispositivos NETGEAR R8500 versión 1.0.2.158, permiten a usuarios remotos autenticados ejecutar comandos arbitrarios (como telnetd) por medio de metacaracteres de shell en los parámetros sysNewPasswd y sysConfirmPasswd del archivo admin_account.cgi • https://github.com/donothingme/VUL/blob/main/vul3/3.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter. Los dispositivos NETGEAR R8500 versión 1.0.2.158, permiten a usuarios remotos autenticados ejecutar comandos arbitrarios (como telnetd) por medio de metacaracteres de shell en los parámetros ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length o ipv6_lan_length • https://github.com/donothingme/VUL/blob/main/vul1/1.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi. Los dispositivos NETGEAR R8500 versión 1.0.2.158, permiten a usuarios remotos autenticados ejecutar comandos arbitrarios (como telnetd) por medio de metacaracteres de shell en los parámetros sysNewPasswd y sysConfirmPasswd del archivo password.cgi • https://github.com/donothingme/VUL/blob/main/vul2/2.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.8EPSS: 0%CPEs: 68EXPL: 0

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. • https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327 https://www.zerodayinitiative.com/advisories/ZDI-22-518 • CWE-863: Incorrect Authorization •

CVSS: 8.0EPSS: 0%CPEs: 68EXPL: 0

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the name or email field provided to libreadycloud.so. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. • https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327 https://www.zerodayinitiative.com/advisories/ZDI-22-524 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •