ID
VAR-202503-3790
CVE
CVE-2024-54805
TITLE
of netgear WNR854T Code injection vulnerability in firmware
Trust: 0.8
DESCRIPTION
Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter get_email. After which, they can visit the send_log.cgi endpoint which uses the parameter in a system call to achieve command execution. of netgear WNR854T A code injection vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. NETGEAR WNR854T is a wireless router from NETGEAR. The vulnerability is caused by the failure of the nvram parameter of the get_email function in the post.cgi file to properly filter special characters and commands in the constructed command. Attackers can exploit this vulnerability to cause arbitrary command execution
Trust: 2.16
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | netgear | model: | wnr854t | scope: | eq | version: | 1.5.2 | Trust: 1.6 |
| vendor: | ネットギア | model: | wnr854t | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | wnr854t | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | wnr854t | scope: | eq | version: | wnr854t firmware 1.5.2 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-94 | Trust: 1.0 |
| problemtype: | Code injection (CWE-94) [ others ] | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-54805 | Trust: 3.2 |
| db: | JVNDB | id: | JVNDB-2024-022386 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2025-07794 | Trust: 0.6 |
REFERENCES
| url: | https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#805 | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-54805 | Trust: 1.4 |
SOURCES
| db: | CNVD | id: | CNVD-2025-07794 |
| db: | JVNDB | id: | JVNDB-2024-022386 |
| db: | NVD | id: | CVE-2024-54805 |
LAST UPDATE DATE
2025-04-22T19:33:10.921000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2025-07794 | date: | 2025-04-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-022386 | date: | 2025-04-18T07:53:00 |
| db: | NVD | id: | CVE-2024-54805 | date: | 2025-04-17T13:04:30.327 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2025-07794 | date: | 2025-04-21T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-022386 | date: | 2025-04-18T00:00:00 |
| db: | NVD | id: | CVE-2024-54805 | date: | 2025-03-31T21:15:47.737 |