Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | N/A |
CWE-ID | CWE-77 |
Exploitation vector | Local network |
Public exploit | N/A |
Vulnerable software |
R7000P Hardware solutions / Routers for home users XR300 Hardware solutions / Routers for home users R8000 Hardware solutions / Routers for home users R7000 Hardware solutions / Routers for home users R7900 Hardware solutions / Routers for home users RBK852 Hardware solutions / Routers & switches, VoIP, GSM, etc RBR850 Hardware solutions / Routers & switches, VoIP, GSM, etc RBS850 Hardware solutions / Routers & switches, VoIP, GSM, etc RBK752 Hardware solutions / Routers & switches, VoIP, GSM, etc RBR750 Hardware solutions / Routers & switches, VoIP, GSM, etc RBS750 Hardware solutions / Routers & switches, VoIP, GSM, etc RAX15 Hardware solutions / Routers & switches, VoIP, GSM, etc RAX20 Hardware solutions / Routers & switches, VoIP, GSM, etc RAX75 Hardware solutions / Routers & switches, VoIP, GSM, etc RAX80 Hardware solutions / Routers & switches, VoIP, GSM, etc RAX200 Hardware solutions / Routers & switches, VoIP, GSM, etc RAX45 Hardware solutions / Routers & switches, VoIP, GSM, etc RAX50 Hardware solutions / Routers & switches, VoIP, GSM, etc MK62 Hardware solutions / Routers & switches, VoIP, GSM, etc MR60 Hardware solutions / Routers & switches, VoIP, GSM, etc MS60 Hardware solutions / Routers & switches, VoIP, GSM, etc R7960P Hardware solutions / Routers & switches, VoIP, GSM, etc R8000P Hardware solutions / Routers & switches, VoIP, GSM, etc |
Vendor | NETGEAR |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU70564
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID:
CWE-77 - Command injection
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation. A remote administrator on the local network can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsR7000P: before 1.3.2.126
RBK852: before 3.2.16.6
RBR850: before 3.2.16.6
RBS850: before 3.2.16.6
XR300: before 1.0.3.50
RBK752: before 3.2.16.6
RBR750: before 3.2.16.6
RBS750: before 3.2.16.6
RAX15: before 1.0.2.82
RAX20: before 1.0.2.82
RAX75: before 1.0.3.106
RAX80: before 1.0.3.106
R8000: before 1.0.4.74
R7000: before 1.0.11.126
RAX200: before 1.0.3.106
RAX45: before 1.0.2.28
RAX50: before 1.0.2.28
MK62: before 1.0.5.102
MR60: before 1.0.5.102
MS60: before 1.0.5.102
R7900: before 1.0.4.46
R7960P: before 1.4.4.94
R8000P: before 1.4.4.94
CPE2.3Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.