NETGEAR

A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7.78.

A support user exists on the device and appears to be a backdoor for Technical Support staff.

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device.

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions.

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute arbitrary code on the device.

Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by re…

NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability.

NETGEAR RAX30 DHCP Server Command Injection Remote Code Execution Vulnerability.

NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability.

NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability.

NETGEAR RAX30 cmsCli_authenticate Stack-based Buffer Overflow Remote Code Execution Vulnerability.

NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability.

When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force the upgrade to complete and bypass certain validation checks.

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that unintentionally allows users with upload permissions to execute arbitrary code on the device.

NETGEAR RAX30 soap_serverd Stack-based Buffer Overflow Authentication Bypass Vulnerability.

NETGEAR RAX30 soap_serverd Stack-based Buffer Overflow Authentication Bypass Vulnerability.

In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files.

Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself.

NETGEAR RAX30 libcms_cli Command Injection Remote Code Execution Vulnerability.

NETGEAR RAX30 lighttpd Misconfiguration Remote Code Execution Vulnerability.

NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly implemented CSRF protections.

NETGEAR RAX30 logCtrl Command Injection Remote Code Execution Vulnerability.

NETGEAR RAX30 rex_cgi JSON Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.

The default console presented to users over telnet (when enabled) is restricted to a subset of commands.

NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability.