Sign-up

VARIoT IoT vulnerabilities database

Affected products: vendor, model and version
CWE format is 'CWE-number'. Threat type can be: remote or local
Look up free text in title and description

VAR-202411-0466 CVE-2024-51008 of netgear  XR300  in the firmware  OS  Command injection vulnerability CVSS V2: 7.7
CVSS V3: 8.0
Severity: HIGH
Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at wiz_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. (DoS) It may be in a state. NETGEAR XR300 is a wireless router from NETGEAR. The vulnerability is caused by the system_name parameter in the wiz_dyn.cgi component failing to properly filter special characters and commands in the constructed command
VAR-202411-1757 CVE-2024-51007 of netgear  XR300  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear XR300 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR XR300 is a wireless router from NETGEAR. The vulnerability is caused by the passphrase parameter in the wireless.cgi component failing to properly verify the length of the input data
VAR-202411-0528 CVE-2024-51006 of netgear  R8500  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_static_ip parameter in the ipv6_tunnel function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear R8500 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the ipv6_static_ip parameter in the ipv6_tunnel function failing to properly verify the length of the input data
VAR-202411-1028 CVE-2024-51005 of netgear  R8500  in the firmware  OS  Command injection vulnerability CVSS V2: 7.7
CVSS V3: 8.0
Severity: HIGH
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the failure of share_name in the usb_remote_smb_conf.cgi component to properly filter special characters and commands in constructing commands
VAR-202411-1064 CVE-2024-51004 of netgear  R8500  firmware and  R7000P  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb_device.cgi via the cifs_user, read_access, and write_access parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear R8500 firmware and R7000P Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500/R7000P is a wireless router from NETGEAR. The vulnerability is caused by the failure of cifs_user, read_access, and write_access in the usb_device.cgi component to properly verify the length of the input data
VAR-202411-2227 CVE-2024-51003 Classic buffer overflow vulnerability in multiple Netgear products CVSS V2: -
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component ap_mode.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. R8500 firmware, XR300 firmware, R7000P A classic buffer overflow vulnerability exists in multiple Netgear products, including firmware.Service operation interruption (DoS) It may be in a state
VAR-202411-2969 CVE-2024-51002 Classic buffer overflow vulnerability in multiple Netgear products CVSS V2: -
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the l2tp_user_ip parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. R8500 firmware, XR300 firmware, R7000P A classic buffer overflow vulnerability exists in multiple Netgear products, including firmware.Service operation interruption (DoS) It may be in a state
VAR-202411-0575 CVE-2024-51001 of netgear  R8500  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sysDNSHost parameter at ddns.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear R8500 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the sysDNSHost parameter in the ddns.cgi component failing to properly verify the length of the input data
VAR-202411-1014 CVE-2024-51000 of netgear  R8500  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component wireless.cgi via the opmode, opmode_an, and opmode_an_2 parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear R8500 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the failure of the opmode, opmode_an, and opmode_an_2 parameters in the wireless.cgi component to properly verify the length of the input data
VAR-202411-1088 CVE-2024-50999 of netgear  R8500  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. of netgear R8500 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the sysNewPasswd parameter in the password.cgi component failing to properly filter special characters and commands in the constructed command
VAR-202411-0606 CVE-2024-50998 of netgear  R8500  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpn_service_port and openvpn_service_port_tun parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear R8500 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the openvpn_service_port and openvpn_service_port_tun parameters in the openvpn.cgi component failing to properly verify the length of the input data
VAR-202411-2043 CVE-2024-50997 Classic buffer overflow vulnerability in multiple Netgear products CVSS V2: -
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. R8500 firmware, XR300 firmware, R7000P A classic buffer overflow vulnerability exists in multiple Netgear products, including firmware.Service operation interruption (DoS) It may be in a state
VAR-202411-2594 CVE-2024-50996 Classic buffer overflow vulnerability in multiple Netgear products CVSS V2: -
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpa_server parameter at genie_bpa.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. R8500 firmware, XR300 firmware, R7000P A classic buffer overflow vulnerability exists in multiple Netgear products, including firmware.Service operation interruption (DoS) It may be in a state
VAR-202411-0987 CVE-2024-50995 of netgear  R8500  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear R8500 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the share_name parameter in the usb_remote_smb_conf.cgi component failing to properly verify the length of the input data
VAR-202411-0558 CVE-2024-50994 of netgear  R8500  Classic buffer overflow vulnerability in firmware CVSS V2: 5.5
CVSS V3: 5.7
Severity: MEDIUM
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6_fix.cgi via the ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request. of netgear R8500 Firmware has a classic buffer overflow vulnerability.Service operation interruption (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the failure of ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length and ipv6_lan_length parameters in the ipv6_fix.cgi component to properly verify the length of the input data
VAR-202411-0328 CVE-2024-50993 of netgear  R8500  in the firmware  OS  Command injection vulnerability CVSS V2: 7.7
CVSS V3: 8.0
Severity: HIGH
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request. (DoS) It may be in a state. NETGEAR R8500 is a wireless router from NETGEAR. The vulnerability is caused by the sysNewPasswd parameter in the admin_account.cgi component failing to properly filter special characters and commands in the constructed command
VAR-202411-3462 CVE-2024-45893 DrayTek Corporation  of  Vigor3900  in the firmware  OS  Command injection vulnerability CVSS V2: -
CVSS V3: 8.0
Severity: HIGH
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`. DrayTek Corporation of Vigor3900 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202411-2434 CVE-2024-45891 DrayTek Corporation  of  Vigor3900  in the firmware  OS  Command injection vulnerability CVSS V2: -
CVSS V3: 8.0
Severity: HIGH
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.`. DrayTek Corporation of Vigor3900 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202411-3178 CVE-2024-45890 DrayTek Corporation  of  Vigor3900  in the firmware  OS  Command injection vulnerability CVSS V2: -
CVSS V3: 8.0
Severity: HIGH
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`. DrayTek Corporation of Vigor3900 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state
VAR-202411-2995 CVE-2024-45889 DrayTek Corporation  of  Vigor3900  in the firmware  OS  Command injection vulnerability CVSS V2: -
CVSS V3: 8.0
Severity: HIGH
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.`. DrayTek Corporation of Vigor3900 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state