CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
NETGEAR WNR2000 Authentication Bypass and Remote Code Execution Vulnerability (CVE-2017-6862)
[Affected Scope] NETGEAR WNR2000v3 (before 1.1.2.14), WNR2000v4 (before 1.0.0.66), and WNR2000v5 (before 1.0.0.42) devices.
[Impact] Unauthenticated remote attackers can bypass authentication and execute arbitrary code with root privileges via a buffer overflow in the web administration interface.
[Mitigation] Apply the official firmware updates immediately and disable remote WAN management on the affected routers.
Netgear Wireless Access Point Remote Command Execution Vulnerability Analysis and Mitigation Guide (CVE-2016-1555)
[Affected Scope] Netgear WN604 (before 3.3.3) and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, WNDAP660 (before 3.5.5.0)
[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by sending crafted HTTP requests
[Mitigation] Apply the official firmware updates immediately, or restrict access to the web management interface from untrusted networks
NETGEAR DGN2200 dnslookup.cgi Remote Command Execution Vulnerability Analysis and Mitigation Guide (CVE-2017-6334)
[Affected Scope] NETGEAR DGN2200 devices running firmware versions up to and including 10.0.0.50
[Impact] Remote authenticated attackers can execute arbitrary OS commands with root privileges by injecting shell metacharacters into the host_name field of an HTTP POST request
[Mitigation] Apply the latest official firmware patch immediately, or disable remote management and restrict access to the admin interface
NETGEAR DGN2200 Router ping.cgi Remote Command Execution (RCE) Vulnerability Advisory (CVE-2017-6077)
[Affected Scope] NETGEAR DGN2200 wireless ADSL2+ modem router devices running firmware versions up to and including 10.0.0.50.
[Impact] Remote authenticated attackers can execute arbitrary OS commands with root privileges via shell metacharacters in the ping_IPAddr parameter of HTTP POST requests, leading to complete device compromise.
[Mitigation] Apply the latest official firmware updates from NETGEAR, disable remote management, and restrict access to the web administration interface.
NETGEAR WNR2000v5 hidden_lang_avi Parameter Buffer Overflow Remote Code Execution (CVE-2016-10174)
[Affected Scope] NETGEAR WNR2000v5 wireless routers.
[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges and fully compromise the device by sending a specially crafted HTTP request.
[Mitigation] Immediately apply the official firmware update from the vendor and disable remote management interfaces.
NETGEAR Routers Administrator Password Disclosure Vulnerability (CVE-2017-5521)
[Affected Scope] Multiple NETGEAR router models including R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000
[Impact] Unauthenticated remote attackers (if remote management is enabled) or local attackers on LAN/WLAN can retrieve the plaintext administrator password
[Mitigation] Apply the latest official firmware updates immediately, or enable the 'Password Recovery' feature and disable remote management as a temporary workaround
NETGEAR Routers cgi-bin Path Info Shell Metacharacter Remote Code Execution (RCE) Vulnerability (CVE-2016-6277)
[Affected Scope] Multiple NETGEAR router models including R6250, R6400, R6700, R6900, R7000, R7100LG, R7300DST, R7900, R8000, D6220, D6400, and D7000
[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges by injecting shell metacharacters into the cgi-bin path info
[Mitigation] Apply the latest official firmware patches provided by the vendor, or temporarily disable the web server as a workaround