CVE-2024-52022

Published: Nov 5, 2024Modified: May 21, 2025

8.0

Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.

Affected (4)

Products: Netgear: R8500 Firmware, Xr300 Firmware, R7000p Firmware, R6400v2 Firmware

4 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear R8500 Firmware	Version 1.0.2.160

Running on/with	Platform Versions
Netgear R8500	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Xr300 Firmware	Version 1.0.3.78

Running on/with	Platform Versions
Netgear Xr300	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear R7000p Firmware	Version 1.3.3.154

Running on/with	Platform Versions
Netgear R7000p	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear R6400v2 Firmware	Version 1.0.4.128

Running on/with	Platform Versions
Netgear R6400v2	All versions

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md

Source: cve@mitre.org

Broken Link

https://www.netgear.com/about/security/

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.