NETGEAR
Page 13 of 14 — NETGEAR CVEs from a corpus of 1360, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-20648 | Low | 3.5 | 2020-04-15 | NETGEAR RN42400 devices before 6.10.2 are affected by incorrect configuration of security settings. |
CVE-2019-20647 | Medium | 5.7 | 2020-04-15 | NETGEAR RAX40 devices before 1.0.3.64 are affected by denial of service. |
CVE-2019-20646 | Critical | 9.8 | 2020-04-15 | NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of administrative credentials. |
CVE-2019-20645 | Medium | 4.8 | 2020-04-15 | NETGEAR RAX40 devices before 1.0.3.62 are affected by stored XSS. |
CVE-2019-20644 | Medium | 4.8 | 2020-04-15 | NETGEAR RAX40 devices before 1.0.3.62 are affected by stored XSS. |
CVE-2019-20643 | High | 7.5 | 2020-04-15 | NETGEAR RAX40 devices before 1.0.3.64 are affected by disclosure of sensitive information. |
CVE-2019-20642 | High | 8.0 | 2020-04-15 | NETGEAR RAX40 devices before 1.0.3.64 are affected by authentication bypass. |
CVE-2019-20641 | High | 8.8 | 2020-04-15 | NETGEAR RAX40 devices before 1.0.3.64 are affected by lack of access control at the function level. |
CVE-2019-20640 | High | 8.8 | 2020-04-15 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76… |
CVE-2019-20639 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, and RBK50 before 2.3.5.30. |
CVE-2019-20638 | Medium | 6.5 | 2020-04-15 | NETGEAR MR1100 devices before 12.06.08.00 are affected by disclosure of administrative credentials. |
CVE-2020-11786 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11785 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11784 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11783 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11782 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11781 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11780 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11779 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11778 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11777 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by Stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11776 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11775 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11774 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11773 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11772 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11771 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11770 | High | 8.8 | 2020-04-15 | Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000v2 before 1… |
CVE-2020-11769 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2020-11768 | Medium | 4.8 | 2020-04-15 | Certain NETGEAR devices are affected by Stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28… |
CVE-2019-20767 | High | 7.2 | 2020-04-15 | Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.60, D3600 before 1.0.0.75, D600… |
CVE-2018-11106 | Critical | 9.8 | 2020-04-01 | NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, ru… |
CVE-2016-11022 | High | 7.2 | 2020-03-23 | NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharac… |
CVE-2019-19964 | Low | 2.7 | 2020-03-23 | On NETGEAR GS728TPS devices through 5.3.0.35, a remote attacker having network connectivity to the web-administration panel can access part of the web panel, b… |
CVE-2019-13395 | High | 8.8 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify all settings including WEP/WPA/WPA2 keys… |
CVE-2019-13394 | Critical | 9.8 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses HTTP Basic Authentication over cleartext HTTP. |
CVE-2019-13393 | High | 7.5 | 2020-03-13 | The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administrative console and the WPA2 pre-shared ke… |
CVE-2019-20489 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ul… |
CVE-2019-20488 | Critical | 9.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injec… |
CVE-2019-20487 | High | 8.8 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticate… |
CVE-2019-20486 | Medium | 6.1 | 2020-03-02 | An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to… |
CVE-2019-12513 | Medium | 6.1 | 2020-02-24 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS a… |
CVE-2019-12512 | Medium | 6.1 | 2020-02-24 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header… |
CVE-2019-12511 | Critical | 9.8 | 2020-02-24 | In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "… |
CVE-2019-12510 | Critical | 9.1 | 2020-02-24 | In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa")… |
CVE-2014-3919 | Critical | 9.3 | 2020-02-13 | A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious… |
CVE-2019-17137 | Critical | 9.4 | 2020-02-10 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR AC1200 R6220 Firmware version 1.1.0.86 Smart… |
CVE-2012-6341 | Medium | 6.5 | 2020-02-06 | An Information Disclosure vulnerability exists in the my config file in NEtGEAR WGR614 v7 and v9, which could let a malicious user recover all previously used… |
CVE-2012-6340 | Medium | 4.6 | 2020-02-06 | An Authentication vulnerability exists in NETGEAR WGR614 v7 and v9 due to a hardcoded credential used for serial programming, a related issue to CVE-2006-1002. |
CVE-2013-3317 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass via the NtgrBak key. |
CVE-2013-3316 | Critical | 9.8 | 2020-01-29 | Netgear WNR1000v3 with firmware before 1.0.2.60 contains an Authentication Bypass due to the server skipping checks for URLs containing a ".jpg". |
CVE-2013-3074 | High | 7.5 | 2020-01-28 | NetGear WNDR4700 Media Server devices with firmware 1.0.0.34 allow remote attackers to cause a denial of service (device crash). |
CVE-2013-3071 | Critical | 9.8 | 2020-01-28 | NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass. |
CVE-2019-19494 | High | 8.8 | 2020-01-09 | Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote attacker to execute arbitrary code at the kernel… |
CVE-2013-3072 | Critical | 9.8 | 2019-11-14 | An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.cgi?/hdd_usr_setup.htm that when visite… |
CVE-2013-3070 | High | 7.5 | 2019-11-14 | An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface, which discloses the PSK of the wi… |
CVE-2013-3073 | Critical | 9.8 | 2019-11-14 | A Symlink Traversal vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34. |
CVE-2013-3516 | Medium | 6.5 | 2019-11-13 | NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows attackers to guess the CSRF tokens. |
CVE-2013-3517 | Medium | 5.4 | 2019-11-13 | Cross-site scripting (XSS) vulnerability in NETGEAR WNR3500U and WNR3500L. |
CVE-2013-4657 | Critical | 9.8 | 2019-11-13 | Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service. |
CVE-2016-11016 | Medium | 6.1 | 2019-10-16 | NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS. |
CVE-2016-11015 | Medium | 6.5 | 2019-10-16 | NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter. |
CVE-2016-11014 | Critical | 9.8 | 2019-10-16 | NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case. |
CVE-2019-17373 | Critical | 9.8 | 2019-10-09 | Certain NETGEAR devices allow unauthenticated access to critical .cgi and .htm pages via a substring ending with .jpg, such as by appending ?x=1.jpg to a URL… |
CVE-2019-17372 | High | 8.1 | 2019-10-09 | Certain NETGEAR devices allow remote attackers to disable all authentication requirements by visiting genieDisableLanChanged.cgi. The attacker can then, for ex… |
CVE-2019-17049 | High | 7.5 | 2019-09-30 | NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account. |
CVE-2019-5055 | High | 7.5 | 2019-09-11 | An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70)… |
CVE-2019-5054 | High | 7.5 | 2019-09-11 | An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000v5 with Firmware Version V1.0.0.70) HTT… |
CVE-2019-14527 | Critical | 9.8 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication. |
CVE-2019-14526 | High | 8.1 | 2019-08-14 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically… |
CVE-2016-10864 | Medium | 5.2 | 2019-08-08 | NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID. |
CVE-2019-14363 | Critical | 9.8 | 2019-07-28 | A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.18_1.0.63 allows an attacker to remotely ex… |
CVE-2018-18471 | Critical | 9.8 | 2019-06-19 | /api/2.0/rest/aggregator/xml in Axentra firmware, used by NETGEAR Stora, Seagate GoFlex Home, and MEDION LifeCloud, has an XXE vulnerability that can be chaine… |
CVE-2019-5017 | Medium | 5.3 | 2019-06-17 | An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadySHARE Printer functionality of at least… |
CVE-2019-5016 | Critical | 9.1 | 2019-06-17 | An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadySHARE Printer functionality of at least… |
CVE-2017-18378 | High | 8.4 | 2019-06-11 | In NETGEAR ReadyNAS Surveillance before 1.4.3-17 x86 and before 1.1.4-7 ARM, $_GET['uploaddir'] is not escaped and is passed to system() through $tmp_upload_di… |
CVE-2019-12591 | Medium | 6.8 | 2019-06-03 | NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection. |
CVE-2016-5649 | Critical | 9.8 | 2018-07-24 | A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, wh… |
CVE-2016-5638 | High | 7.5 | 2018-07-24 | There are few web pages associated with the genie app on the Netgear WNDR4500 running firmware version V1.0.1.40_1.0.6877. Genie app adds some capabilities ove… |
CVE-2017-6862 | Critical | 9.8 | 2017-05-26 | NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code… |
CVE-2017-2137 | Low | 3.7 | 2017-04-28 | ProSAFE Plus Configuration Utility prior to 2.3.29 allows remote attackers to bypass access restriction and change configurations of the switch via SOAP reques… |
CVE-2016-1557 | Critical | 9.8 | 2017-04-21 | Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP. |
CVE-2016-1556 | High | 7.5 | 2017-04-21 | Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allows remote attackers… |
CVE-2016-1555 | Critical | 9.8 | 2017-04-21 | (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP2… |
CVE-2017-6366 | High | 8.8 | 2017-03-15 | Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the auth… |
CVE-2017-6334 | High | 8.8 | 2017-03-06 | dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metachara… |
CVE-2017-6077 | Critical | 9.8 | 2017-02-22 | ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters… |
CVE-2016-10176 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special U… |
CVE-2016-10175 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain… |
CVE-2016-10174 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflo… |
CVE-2017-5521 | High | 8.1 | 2017-01-17 | An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They ar… |
CVE-2016-10116 | High | 8.1 | 2017-01-04 | NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8… |
CVE-2016-10115 | Critical | 9.8 | 2017-01-04 | NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8… |
CVE-2016-10106 | Medium | 6.5 | 2017-01-03 | Directory traversal vulnerability in scgi-bin/platform.cgi on NETGEAR FVS336Gv3, FVS318N, FVS318Gv2, and SRX5308 devices with firmware before 4.3.3-8 allows re… |
CVE-2016-6277 | High | 8.8 | 2016-12-14 | NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R730… |
CVE-2016-5680 | High | 8.8 | 2016-08-31 | Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users… |
CVE-2016-5679 | High | 8.8 | 2016-08-31 | cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands… |
CVE-2016-5677 | High | 7.5 | 2016-08-31 | NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 passwo… |
CVE-2016-5676 | High | 7.5 | 2016-08-31 | cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote att… |
CVE-2016-5675 | Critical | 9.8 | 2016-08-31 | handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surve… |