R6400 Firmware vulnerabilities

14 known vulnerabilities in R6400 Firmware from NETGEAR. 14 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  r7000p_firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2024-52022Nov 5, 2024NETGEAREPSS 1%

  Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbi

• 8.0 High severity

  r7000p_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-52021Nov 5, 2024NETGEAREPSS 1%

  Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at bsw_fix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.

• 8.0 High severity

  r7000p_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-52020Nov 5, 2024NETGEAREPSS 1%

  Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at wiz_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.

• 8.0 High severity

  r7000p_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-51021Nov 5, 2024NETGEAR

  Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injection vulnerability via the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted r

• 8.0 High severity

  r7000p_firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-51010Nov 5, 2024NETGEAR

  Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbi

• 9.8 Critical severity

  r6400v2: Buffer Copy without Checking Size of Input

  CVE-2023-36187Sep 1, 2023NETGEAREPSS 1.13%

  Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to httpd.

• 8.0 High severity

  R6700v3: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-27647Mar 29, 2023NETGEAREPSS 1.48%

  This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can

• 8.8 High severity

  R6700v3: Stack-based Buffer Overflow

  CVE-2022-27646Mar 29, 2023NETGEAREPSS 1.43%

  This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can

• 8.8 High severity

  R6700v3: Incorrect Comparison

  CVE-2022-27645Mar 29, 2023NETGEAREPSS 1.28%

  This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloud_control.cgi. The issue

• 8.8 High severity

  R6700v3: Improper Certificate Validation

  CVE-2022-27644Mar 29, 2023NETGEAR

  This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw e

• 8.8 High severity

  R6700v3: Buffer Copy without Checking Size of Input

  CVE-2022-27643Mar 29, 2023NETGEAREPSS 25.4%

  This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of

• 8.8 High severity

  R6700v3: Incorrect Authorization

  CVE-2022-27642Mar 29, 2023NETGEAR

  This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd servic

• 8.8 High severity

  R6700v3: Integer Overflow or Wraparound

  CVE-2022-27641Mar 29, 2023NETGEAREPSS 1.23%

  This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB modu

• 8.8 High severity

  NETGEAR Multiple Routers Remote Code Execution Exploited

  CVE-2016-6277Dec 14, 2016NETGEAREPSS 99.8%

  NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000