ID
VAR-202503-3517
CVE
CVE-2024-54807
TITLE
of netgear WNR854T Code injection vulnerability in firmware
Trust: 0.8
DESCRIPTION
In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient parameter of the AddPortMapping SOAPAction into a system call without sanitation. An attacker can send a specially crafted SOAPAction request for AddPortMapping via the router's WANIPConn1 service to achieve arbitrary command execution. of netgear WNR854T A code injection vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NETGEAR WNR854T is a wireless router from NETGEAR. NETGEAR WNR854T 1.5.2 version has a command execution vulnerability, which is caused by the addmap_exec function failing to properly filter special characters and commands in constructing commands
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | netgear | model: | wnr854t | scope: | eq | version: | 1.5.2 | Trust: 1.6 |
| vendor: | ネットギア | model: | wnr854t | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | wnr854t | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | wnr854t | scope: | eq | version: | wnr854t firmware 1.5.2 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-94 | Trust: 1.0 |
| problemtype: | Code injection (CWE-94) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-54807 | Trust: 3.2 |
| db: | JVNDB | id: | JVNDB-2024-022375 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-07792 | Trust: 0.6 |
REFERENCES
| url: | https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#807 | Trust: 2.4 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-54807 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2025-07792 |
| db: | JVNDB | id: | JVNDB-2024-022375 |
| db: | NVD | id: | CVE-2024-54807 |
LAST UPDATE DATE
2025-04-22T19:33:10.954000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-07792 | date: | 2025-04-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-022375 | date: | 2025-04-18T06:23:00 |
| db: | NVD | id: | CVE-2024-54807 | date: | 2025-04-17T13:00:32.320 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-07792 | date: | 2025-04-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-022375 | date: | 2025-04-18T00:00:00 |
| db: | NVD | id: | CVE-2024-54807 | date: | 2025-03-31T21:15:48.090 |