Vendor writes it as "NETGEAR"
parent
b7a0722759
commit
86f3c08ba6
|
@ -1,7 +1,7 @@
|
|||
id: CVE-2016-5649
|
||||
|
||||
info:
|
||||
name: Netgear DGN2200 / DGND3700 - Admin Password Disclosure
|
||||
name: NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure
|
||||
author: suman_kar
|
||||
severity: critical
|
||||
description: Vulnerability exists within the page 'BSW_cxttongr.htm' which can allow a remote attacker to access this page without any authentication. Attacker can use this password to gain administrator access of the targeted routers web interface.
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
id: CVE-2020-26919
|
||||
|
||||
info:
|
||||
name: Netgear ProSAFE Plus - Unauthenticated Remote Code Execution
|
||||
name: NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution
|
||||
author: gy741
|
||||
severity: critical
|
||||
description: It was found that every section of the web could be used as a valid endpoint to submit POST requests being the action defined by the submitId argument. The problem was located in the login.html webpage, that has to be publicly available to perform login requests but does not implement any restriction for executing debug actions. This will allow users execute system commands.
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
id: CVE-2020-27866
|
||||
|
||||
info:
|
||||
name: Netgear Authentication Bypass vulnerability
|
||||
name: NETGEAR Authentication Bypass vulnerability
|
||||
author: gy741
|
||||
severity: high
|
||||
description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers. Authentication is not required to exploit this vulnerability.
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
id: netgear-router-auth-bypass
|
||||
|
||||
info:
|
||||
name: Netgear DGN2200v1 Router Authentication Bypass
|
||||
name: NETGEAR DGN2200v1 Router Authentication Bypass
|
||||
author: gy741
|
||||
severity: high
|
||||
description: NETGEAR decided to use to check if a page has “.jpg”, “.gif” or “ess_” substrings, trying to match the entire URL. We can therefore access any page on the device, including those that require authentication, by appending a GET variable with the relevant substring (like “?.gif”).
|
||||
|
|
|
@ -1,8 +1,8 @@
|
|||
id: netgear-router-exposure
|
||||
|
||||
info:
|
||||
name: Netgear Router S/N Disclosure
|
||||
description: Multiple Netgear router models disclose their serial number which can be used to obtain the admin password if password recovery is enabled.
|
||||
name: NETGEAR Router S/N Disclosure
|
||||
description: Multiple NETGEAR router models disclose their serial number which can be used to obtain the admin password if password recovery is enabled.
|
||||
reference:
|
||||
- https://www.exploit-db.com/exploits/47117
|
||||
- https://www.exploit-db.com/exploits/45741
|
||||
|
|
|
@ -1,10 +1,10 @@
|
|||
id: netgear-wnap320-rce
|
||||
|
||||
info:
|
||||
name: Netgear WNAP320 Access Point - Remote Code Execution (Unauthenticated)
|
||||
name: NETGEAR WNAP320 Access Point - Remote Code Execution (Unauthenticated)
|
||||
author: gy741
|
||||
severity: critical
|
||||
description: vulnerabilities in the web-based management interface of Netgear WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
|
||||
description: vulnerabilities in the web-based management interface of NETGEAR WNAP320 Access Point could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
|
||||
reference:
|
||||
- https://github.com/nobodyatall648/Netgear-WNAP320-Firmware-Version-2.0.3-RCE
|
||||
tags: netgear,rce,oob,router
|
||||
|
|
Loading…
Reference in New Issue