Vendor writes it as "NETGEAR"

patch-1
Noam Rathaus 2021-08-29 09:39:06 +03:00
parent b7a0722759
commit 86f3c08ba6
6 changed files with 8 additions and 8 deletions

View File

@ -1,7 +1,7 @@
id: CVE-2016-5649
info:
name: Netgear DGN2200 / DGND3700 - Admin Password Disclosure
name: NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure
author: suman_kar
severity: critical
description: Vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. Attacker can use this password to gain administrator access of the targeted routers web interface.

View File

@ -1,7 +1,7 @@
id: CVE-2020-26919
info:
name: Netgear ProSAFE Plus - Unauthenticated Remote Code Execution
name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
author: gy741
severity: critical
description: It was found that every section of the web could be used as a valid endpoint to submit POST requests being the action defined by the submitId argument. The problem was located in the login.html webpage, that has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow users execute system commands.

View File

@ -1,7 +1,7 @@
id: CVE-2020-27866
info:
name: Netgear Authentication Bypass vulnerability
name: NETGEAR Authentication Bypass vulnerability
author: gy741
severity: high
description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability.

View File

@ -1,7 +1,7 @@
id: netgear-router-auth-bypass
info:
name: Netgear DGN2200v1 Router Authentication Bypass
name: NETGEAR DGN2200v1 Router Authentication Bypass
author: gy741
severity: high
description: NETGEAR decided to use to check if a page has “.jpg”, “.gif” or “ess_” substrings, trying to match the entire URL. We can therefore access any page on the device, including those that require authentication, by appending a GET variable with the relevant substring (like “?.gif”).

View File

@ -1,8 +1,8 @@
id: netgear-router-exposure
info:
name: Netgear Router S/N Disclosure
description: Multiple Netgear router models disclose their serial number which can be used to obtain the admin password if password recovery is enabled.
name: NETGEAR Router S/N Disclosure
description: Multiple NETGEAR router models disclose their serial number which can be used to obtain the admin password if password recovery is enabled.
reference:
- https://www.exploit-db.com/exploits/47117
- https://www.exploit-db.com/exploits/45741

View File

@ -1,10 +1,10 @@
id: netgear-wnap320-rce
info:
name: Netgear WNAP320 Access Point - Remote Code Execution (Unauthenticated)
name: NETGEAR WNAP320 Access Point - Remote Code Execution (Unauthenticated)
author: gy741
severity: critical
description: vulnerabilities in the web-based management interface of Netgear WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
description: vulnerabilities in the web-based management interface of NETGEAR WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
reference:
- https://github.com/nobodyatall648/Netgear-WNAP320-Firmware-Version-2.0.3-RCE
tags: netgear,rce,oob,router