ID
VAR-202503-3141
CVE
CVE-2024-54803
TITLE
of netgear WNR854T Code injection vulnerability in firmware
Trust: 0.8
DESCRIPTION
Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter pppoe_peer_mac and forcing a reboot. This will result in command injection. of netgear WNR854T A code injection vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NETGEAR WNR854T is a wireless router from NETGEAR. The vulnerability is caused by the failure of the nvram parameter of the pppoe_peer_mac function in the post.cgi file to properly filter special characters and commands in the constructed command. Attackers can exploit this vulnerability to cause arbitrary command execution
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | netgear | model: | wnr854t | scope: | eq | version: | 1.5.2 | Trust: 1.6 |
| vendor: | ネットギア | model: | wnr854t | scope: | eq | version: | wnr854t firmware 1.5.2 | Trust: 0.8 |
| vendor: | ネットギア | model: | wnr854t | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | wnr854t | scope: | eq | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-94 | Trust: 1.0 |
| problemtype: | Code injection (CWE-94) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-54803 | Trust: 3.2 |
| db: | JVNDB | id: | JVNDB-2024-022668 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-07796 | Trust: 0.6 |
REFERENCES
| url: | https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#803 | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-54803 | Trust: 1.4 |
SOURCES
| db: | CNVD | id: | CNVD-2025-07796 |
| db: | JVNDB | id: | JVNDB-2024-022668 |
| db: | NVD | id: | CVE-2024-54803 |
LAST UPDATE DATE
2025-04-25T01:57:43.873000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-07796 | date: | 2025-04-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-022668 | date: | 2025-04-23T03:19:00 |
| db: | NVD | id: | CVE-2024-54803 | date: | 2025-04-22T18:16:52.410 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-07796 | date: | 2025-04-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-022668 | date: | 2025-04-23T00:00:00 |
| db: | NVD | id: | CVE-2024-54803 | date: | 2025-03-31T21:15:47.377 |