CVSS: 8.8EPSS: 0%CPEs: 68EXPL: 0CVE-2022-27642 – NETGEAR R6700v3 httpd Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-27642
23 Mar 2022 — This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. • https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327 • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 46EXPL: 0CVE-2022-27645 – NETGEAR R6700v3 readycloud_control.cgi Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-27645
23 Mar 2022 — This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloud_control.cgi. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. • https://kb.netgear.com/000064722/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Fixed-Wireless-Products-PSV-2021-0325 • CWE-306: Missing Authentication for Critical Function CWE-697: Incorrect Comparison •
CVSS: 8.0EPSS: 0%CPEs: 68EXPL: 0CVE-2022-27647 – NETGEAR R6700v3 libreadycloud.so Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-27647
23 Mar 2022 — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the name or email field provided to libreadycloud.so. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can ... • https://kb.netgear.com/000064723/Security-Advisory-for-Multiple-Vulnerabilities-on-Multiple-Products-PSV-2021-0327 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20169
https://notcve.org/view.php?id=CVE-2021-20169
30 Dec 2021 — Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext. Netgear RAX43 versión 1.0.3.96, no usa comunicaciones seguras con la interfaz web. Por defecto, toda la comunicación hacia/desde el dispositivo se envía por medio de HTTP, lo que causa que información potencialmente confidencial (como nombr... • https://www.tenable.com/security/research/tra-2021-55 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.0EPSS: 83%CPEs: 2EXPL: 0CVE-2021-20167
https://notcve.org/view.php?id=CVE-2021-20167
30 Dec 2021 — Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter. Netgear RAX43 versión 1.0.3.96, contiene una vulnerabilidad de inyección de comandos. La aplicación readycloud cgi es vulnerable a la inyección de comandos en el parámetro name. • https://www.tenable.com/security/research/tra-2021-55 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20168
https://notcve.org/view.php?id=CVE-2021-20168
30 Dec 2021 — Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, login with default credentials, and execute commands as the root user. These default credentials are admin:admin. Netgear RAX43 versión 1.0.3.96, no presenta suficientes protecciones para la interfaz UART. Un actor malicioso con acceso físico al dispositivo es capaz de conectarse al puerto UART por medio d... • https://www.tenable.com/security/research/tra-2021-55 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 54%CPEs: 2EXPL: 0CVE-2021-20166
https://notcve.org/view.php?id=CVE-2021-20166
30 Dec 2021 — Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton. Netgear RAX43 versión 1.0.3.96, contiene una vulnerabilidad de desbordamiento de búfer. La funcionalidad URL parsing en el endpoint cgi-bin del enrutador contiene un problema de desbordamiento del búfer que puede redirigir el flujo de control de la aplicación. • https://www.tenable.com/security/research/tra-2021-55 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20170
https://notcve.org/view.php?id=CVE-2021-20170
30 Dec 2021 — Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed... • https://www.tenable.com/security/research/tra-2021-55 • CWE-798: Use of Hard-coded Credentials •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20171
https://notcve.org/view.php?id=CVE-2021-20171
30 Dec 2021 — Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device. Netgear RAX43 versión 1.0.3.96, almacena información confidencial en texto plano. Todos los nombres de usuario y contraseñas de los servicios asociados al dispositivo se almacenan en texto plano en el dispositivo. • https://www.tenable.com/security/research/tra-2021-55 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 8.4EPSS: 0%CPEs: 54EXPL: 0CVE-2021-45549
https://notcve.org/view.php?id=CVE-2021-45549
26 Dec 2021 — Certain NETGEAR devices are affected by command injection by an authenticated user. This affects LAX20 before 1.1.6.28, MK62 before 1.1.6.122, MR60 before 1.1.6.122, MS60 before 1.1.6.122, R6400v2 before 1.0.4.118, R6700v3 before 1.0.4.118, R6900P before 1.3.3.140, R7000 before 1.0.11.116, R7000P before 1.3.3.140, R7850 before 1.0.5.68, R7900 before 1.0.4.38, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000 before 1.0.4.68, R8000P before 1.4.2.84, RAX15 before 1.0.3.96, RAX20 before 1.0.3.96, RAX200 be... • https://kb.netgear.com/000064513/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0517 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •