| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| NETGEAR WAC505 devices before 8.2.1.16 are affected by disclosure of sensitive information. |
| Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 8.2.1.16 and WAC510 before 8.2.1.16. |
| Certain NETGEAR devices are affected by denial of service. This affects R8900 before 1.0.5.2, R9000 before 1.0.5.2, XR500 before 2.3.2.56, and XR700 before 1.0.1.20. |
| NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of sensitive information. |
| NETGEAR RN42400 devices before 6.10.2 are affected by incorrect configuration of security settings. |
| NETGEAR RAX40 devices before 1.0.3.64 are affected by denial of service. |
| NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of administrative credentials. |
| NETGEAR RAX40 devices before 1.0.3.62 are affected by stored XSS. |
| NETGEAR RAX40 devices before 1.0.3.62 are affected by stored XSS. |
| NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of sensitive information. |
| NETGEAR RAX40 devices before 1.0.3.64 are affected by authentication bypass. |
| NETGEAR RAX40 devices before 1.0.3.64 are affected by lack of access control at the function level. |
| Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6200 before 1.1.00.32, D7000 before 1.0.1.68, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.38, R6050 before 1.0.1.18, R6080 before 1.0.0.38, R6120 before 1.0.0.46, R6220 before 1.1.0.80, R6260 before 1.1.0.40, R6700v2 before 1.2.0.36, R6800 before 1.2.0.36, R6900v2 before 1.2.0.36, WNR2020 before 1.1.0.62, and XR500 before 2.3.2.32. |
| Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and RBK50 before 2.3.5.30. |
| NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of administrative credentials. |
| An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an FW_remote.htm&todo=cfg_init request without a cookie, reads the Set-Cookie header in the 401 Unauthorized response, and then repeats the FW_remote.htm&todo=cfg_init request with the specified cookie. |
| An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injection, allowing remote attackers to execute arbitrary commands, as demonstrated by shell metacharacters in the sysDNSHost parameter. |
| An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or through CSRF), as demonstrated by the setup.cgi?todo=save_htp_account URI. |
| An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language. |
| On NETGEAR GS728TPS devices through 5.3.0.35, a remote attacker having network connectivity to the web-administration panel can access part of the web panel, bypassing authentication. |
