R8500 Firmware vulnerabilities

15 known vulnerabilities in R8500 Firmware from NETGEAR. 15 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

15vulnerabilities

0critical

15high

0exploited

8.3average CVSS score

Latest first

8.0 High severity
r7000p_firmware: Improper Neutralization of Special Elements used in a Command
CVE-2024-52022Nov 5, 2024NETGEAREPSS 1%
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbi
8.0 High severity
r7000p_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-52021Nov 5, 2024NETGEAREPSS 1%
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at bsw_fix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
8.0 High severity
r7000p_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-52020Nov 5, 2024NETGEAREPSS 1%
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at wiz_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
8.0 High severity
r8500_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-52019Nov 5, 2024NETGEAREPSS 1.63%
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
8.0 High severity
r7000p_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-51010Nov 5, 2024NETGEAR
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbi
8.0 High severity
r8500_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-51009Nov 5, 2024NETGEAR
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
8.0 High severity
r8500_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-51005Nov 5, 2024NETGEAR
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
8.0 High severity
r8500_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2024-50993Nov 5, 2024NETGEAR
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
8.0 High severity
R6700v3: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27647Mar 29, 2023NETGEAREPSS 1.48%
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can
8.8 High severity
R6700v3: Incorrect Comparison
CVE-2022-27645Mar 29, 2023NETGEAREPSS 1.28%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within readycloud_control.cgi. The issue
8.8 High severity
R6700v3: Buffer Copy without Checking Size of Input
CVE-2022-27643Mar 29, 2023NETGEAREPSS 25.4%
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of
8.8 High severity
R6700v3: Incorrect Authorization
CVE-2022-27642Mar 29, 2023NETGEAR
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd servic
8.8 High severity
R8500 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27947Mar 26, 2022NETGEAREPSS 2.86%
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter.
8.8 High severity
R8500 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27946Mar 26, 2022NETGEAREPSS 3.25%
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.
8.8 High severity
R8500 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27945Mar 26, 2022NETGEAREPSS 2.94%
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.