cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2021-20174,https://securityvulnerability.io/vulnerability/CVE-2021-20174,Insecure Communication Vulnerability in Netgear Nighthawk R6700 Router,"The Netgear Nighthawk R6700 router, specifically version 1.0.4.120, presents an insecure communication vulnerability due to the lack of secure methods for transmitting data to and from the web interface. This device relies on HTTP protocols by default, which can expose potentially sensitive information, including usernames and passwords, in cleartext. As a result, attackers could intercept and exploit this data, posing a serious threat to the device's users.",Netgear,Netgear Nighthawk R6700,7.5,HIGH,0.0020099999383091927,false,,false,false,false,,,false,false,,2021-12-30T21:31:23.000Z,0
CVE-2021-20175,https://securityvulnerability.io/vulnerability/CVE-2021-20175,SOAP Interface Vulnerability in Netgear Nighthawk Router,"The Netgear Nighthawk R6700 router, specifically version 1.0.4.120, has a significant security vulnerability in its SOAP interface. This vulnerability arises from the use of unsecure communication methods, as all data exchanged with the SOAP interface at port 5000 is transmitted over HTTP. Consequently, sensitive information such as usernames and passwords may be exposed in plaintext, making it susceptible to interception by attackers. This flaw underlines the necessity for secure communication protocols to protect user data.",Netgear,Netgear Nighthawk R6700,7.5,HIGH,0.0020099999383091927,false,,false,false,false,,,false,false,,2021-12-30T21:31:23.000Z,0
CVE-2021-20173,https://securityvulnerability.io/vulnerability/CVE-2021-20173,Command Injection Vulnerability in Netgear Nighthawk R6700 Device,"The Netgear Nighthawk R6700 device, specifically version 1.0.4.120, is affected by a command injection vulnerability within its update functionality. This issue arises when an update check is triggered via the SOAP interface, allowing potential attackers to inject commands through preconfigured values. This could lead to unauthorized actions being executed on the device, compromising its security.",Netgear,Netgear Nighthawk R6700,8.8,HIGH,0.010590000078082085,false,,false,false,false,,,false,false,,2021-12-30T21:31:22.000Z,0
CVE-2021-45077,https://securityvulnerability.io/vulnerability/CVE-2021-45077,Plaintext Credential Storage in Netgear Nighthawk Router,"The Netgear Nighthawk R6700 router version 1.0.4.120 exposes sensitive information by storing all usernames and passwords in plaintext on the device. This practice poses significant risks to user security, as it makes it easy for unauthorized individuals to access sensitive configurations and take control of associated services. Proper handling and encryption of credentials are crucial to maintain the integrity and security of the device.",Netgear,Netgear Nighthawk R6700,7.5,HIGH,0.0020099999383091927,false,,false,false,false,,,false,false,,2021-12-30T21:31:21.000Z,0
CVE-2021-45732,https://securityvulnerability.io/vulnerability/CVE-2021-45732,Hardcoded Credential Vulnerability in Netgear Nighthawk R6700 Router,"The Netgear Nighthawk R6700 router version 1.0.4.120 is impacted by a vulnerability involving hardcoded credentials that allow potential attackers to exploit configuration backups. Although these backups are encrypted and intended for internal use only, malicious users can utilize commonly available tools to extract and manipulate these configurations. This manipulation can lead to unauthorized changes, posing significant security risks to the router's settings and overall network integrity.",Netgear,Netgear Nighthawk R6700,8.8,HIGH,0.0008699999889358878,false,,false,false,false,,,false,false,,2021-12-30T21:31:20.000Z,0
CVE-2021-23147,https://securityvulnerability.io/vulnerability/CVE-2021-23147,Insufficient UART Console Protection in Netgear Router,"The Netgear Nighthawk R6700 version 1.0.4.120 is susceptible to a vulnerability that stems from inadequate protections for its UART console. This flaw allows an attacker with physical access to the device to connect through the UART port using a serial connection. Once access is gained, the attacker can execute commands with root privileges without requiring any form of authentication, posing a significant risk to the security of the device and potentially the wider network.",Netgear,Netgear Nighthawk R6700,6.8,MEDIUM,0.0012199999764561653,false,,false,false,false,,,false,false,,2021-12-30T21:31:20.000Z,0
CVE-2021-29068,https://securityvulnerability.io/vulnerability/CVE-2021-29068,,"Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.98, R6400v2 before 1.0.4.98, R7000 before 1.0.11.106, R6900P before 1.3.2.124, R7000P before 1.3.2.124, R7900 before 1.0.4.26, R7850 before 1.0.5.60, R8000 before 1.0.4.58, RS400 before 1.5.0.48, R6400 before 1.0.1.62, R6700 before 1.0.2.16, R6900 before 1.0.2.16, MK60 before 1.0.5.102, MR60 before 1.0.5.102, MS60 before 1.0.5.102, CBR40 before 2.5.0.10, R8000P before 1.4.1.62, R7960P before 1.4.1.62, R7900P before 1.4.1.62, RAX15 before 1.0.1.64, RAX20 before 1.0.1.64, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, RAX200 before 1.0.2.102, RAX45 before 1.0.2.64, RAX50 before 1.0.2.64, EX7500 before 1.0.0.68, EAX80 before 1.0.1.62, EAX20 before 1.0.0.36, RBK752 before 3.2.16.6, RBK753 before 3.2.16.6, RBK753S before 3.2.16.6, RBK754 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBK853 before 3.2.16.6, RBK854 before 3.2.16.6, RBR850 before 3.2.16.6, RBS850 before 3.2.16.6, RBR840 before 3.2.16.6, RBS840 before 3.2.16.6, R6120 before 1.0.0.70, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.76, R6850 before 1.1.0.76, R6350 before 1.1.0.76, R6330 before 1.1.0.76, D7800 before 1.0.1.58, RBK50 before 2.6.1.40, RBR50 before 2.6.1.40, RBS50 before 2.6.1.40, RBK40 before 2.6.1.36, RBR40 before 2.6.1.36, RBS40 before 2.6.1.38, RBK23 before 2.6.1.36, RBR20 before 2.6.1.38, RBS20 before 2.6.1.38, RBK12 before 2.6.1.44, RBK13 before 2.6.1.44, RBK14 before 2.6.1.44, RBK15 before 2.6.1.44, RBR10 before 2.6.1.44, RBS10 before 2.6.1.44, R6800 before 1.2.0.72, R6900v2 before 1.2.0.72, R6700v2 before 1.2.0.72, R7200 before 1.2.0.72, R7350 before 1.2.0.72, R7400 before 1.2.0.72, R7450 before 1.2.0.72, AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600 before 1.2.0.72, R7800 before 1.0.2.74, R8900 before 1.0.5.24, R9000 before 1.0.5.24, RAX120 before 1.0.1.136, XR450 before 2.3.2.66, XR500 before 2.3.2.66, XR700 before 1.0.1.34, and XR300 before 1.0.3.50.",Netgear,R6700 Firmware,9.9,CRITICAL,0.0009599999757483602,false,,false,false,false,,,false,false,,2021-03-23T06:57:00.000Z,0
CVE-2020-15634,https://securityvulnerability.io/vulnerability/CVE-2020-15634,,This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9755.,Netgear,R6700,6.3,MEDIUM,0.0013200000394135714,false,,false,false,false,,,false,false,,2020-08-20T01:17:00.000Z,0
CVE-2020-15635,https://securityvulnerability.io/vulnerability/CVE-2020-15635,,"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers with firmware 1.0.4.84_10.0.58. Authentication is not required to exploit this vulnerability. The specific flaw exists within the acsd service, which listens on TCP port 5916 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9853.",Netgear,R6700,8.8,HIGH,0.0023799999617040157,false,,false,false,false,,,false,false,,2020-08-20T01:17:00.000Z,0
CVE-2020-15416,https://securityvulnerability.io/vulnerability/CVE-2020-15416,,"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9703.",Netgear,R6700,8.8,HIGH,0.0019000000320374966,false,,false,false,true,2020-10-09T23:42:50.000Z,true,false,false,,2020-07-28T17:10:39.000Z,0
CVE-2020-15417,https://securityvulnerability.io/vulnerability/CVE-2020-15417,,This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted gui_region in a string table file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9756.,Netgear,R6700,6.3,MEDIUM,0.0007099999929778278,false,,false,false,false,,,false,false,,2020-07-28T17:10:39.000Z,0
CVE-2020-10930,https://securityvulnerability.io/vulnerability/CVE-2020-10930,,"This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from the lack of proper routing of URLs. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-9618.",Netgear,R6700,6.5,MEDIUM,0.0005300000193528831,false,,false,false,false,,,false,false,,2020-07-28T17:10:38.000Z,0
CVE-2020-10929,https://securityvulnerability.io/vulnerability/CVE-2020-10929,,"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9768.",Netgear,R6700,8.8,HIGH,0.0006699999794363976,false,,false,false,false,,,false,false,,2020-07-28T17:10:38.000Z,0
CVE-2020-10927,https://securityvulnerability.io/vulnerability/CVE-2020-10927,,This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue results from the use of an inappropriate encryption algorithm. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9649.,Netgear,R6700,7.5,HIGH,0.0006500000017695129,false,,false,false,false,,,false,false,,2020-07-28T17:10:37.000Z,0
CVE-2020-10928,https://securityvulnerability.io/vulnerability/CVE-2020-10928,,"This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9767.",Netgear,R6700,8.4,HIGH,0.0006200000061653554,false,,false,false,false,,,false,false,,2020-07-28T17:10:37.000Z,0
CVE-2020-10926,https://securityvulnerability.io/vulnerability/CVE-2020-10926,,This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648.,Netgear,R6700,7.5,HIGH,0.0006500000017695129,false,,false,false,false,,,false,false,,2020-07-28T17:10:36.000Z,0
CVE-2020-10925,https://securityvulnerability.io/vulnerability/CVE-2020-10925,,This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9647.,Netgear,R6700,7.5,HIGH,0.0006500000017695129,false,,false,false,false,,,false,false,,2020-07-28T17:10:36.000Z,0
CVE-2020-10924,https://securityvulnerability.io/vulnerability/CVE-2020-10924,,"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9643.",Netgear,R6700,8.8,HIGH,0.003470000112429261,false,,false,false,false,,,false,false,,2020-07-28T17:10:36.000Z,0
CVE-2020-10923,https://securityvulnerability.io/vulnerability/CVE-2020-10923,,"This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.",Netgear,R6700,6.5,MEDIUM,0.0007399999885819852,false,,false,false,false,,,false,false,,2020-07-28T17:10:35.000Z,0
CVE-2017-18701,https://securityvulnerability.io/vulnerability/CVE-2017-18701,,Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34.,Netgear,R6700 Firmware,5.2,MEDIUM,0.0007800000021234155,false,,false,false,false,,,false,false,,2020-04-24T14:12:14.000Z,0
CVE-2018-21135,https://securityvulnerability.io/vulnerability/CVE-2018-21135,,"Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700 before 1.0.1.48, R7500 before 1.0.0.124, R7800 before 1.0.2.58, R8900 before 1.0.4.2, R9000 before 1.0.4.2, WNDR3700v4 before 1.0.2.102, WNDR4300v1 before 1.0.2.104, WNDR4300v2 before 1.0.0.56, WNDR4500v3 before 1.0.0.56, and WNR2000v5-R2000 before 1.0.0.68.",Netgear,R6700 Firmware,6.8,MEDIUM,0.0009599999757483602,false,,false,false,false,,,false,false,,2020-04-23T20:02:40.000Z,0
CVE-2018-21134,https://securityvulnerability.io/vulnerability/CVE-2018-21134,,"Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6700 before 1.0.1.48, R7900 before 1.0.2.16, R6900 before 1.0.1.48, R7000P before 1.3.1.44, R6900P before 1.3.1.44, R6250 before 1.0.4.30, R6300v2 before 1.0.4.32, R6400 before 1.0.1.44, R6400v2 before 1.0.2.60, R7000 before 1.0.9.34, R7100LG before 1.0.0.48, R7300 before 1.0.0.68, R8000 before 1.0.4.18, R8000P before 1.4.1.24, R7900P before 1.4.1.24, R8500 before 1.0.2.122, R8300 before 1.0.2.122, WN2500RPv2 before 1.0.1.54, EX3700 before 1.0.0.72, EX3800 before 1.0.0.72, EX6000 before 1.0.0.32, EX6100 before 1.0.2.24, EX6120 before 1.0.0.42, EX6130 before 1.0.0.24, EX6150v1 before 1.0.0.42, EX6200 before 1.0.3.88, EX7000 before 1.0.0.66, D7000v2 before 1.0.0.51, D6220 before 1.0.0.46, D6400 before 1.0.0.82, and D8500 before 1.0.3.42.",Netgear,R6700 Firmware,6.8,MEDIUM,0.0024999999441206455,false,,false,false,false,,,false,false,,2020-04-23T20:00:55.000Z,0
CVE-2017-18758,https://securityvulnerability.io/vulnerability/CVE-2017-18758,,"Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.",Netgear,R6700 Firmware,8.8,HIGH,0.0004400000034365803,false,,false,false,false,,,false,false,,2020-04-22T16:04:53.000Z,0
CVE-2017-18790,https://securityvulnerability.io/vulnerability/CVE-2017-18790,,"Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R6700 before 1.0.1.26, R7000 before 1.0.9.10, R7100LG before 1.0.0.32, R7900 before 1.0.1.18, R8000 before 1.0.3.54, and R8500 before 1.0.2.100.",Netgear,R6700 Firmware,6.2,MEDIUM,0.000699999975040555,false,,false,false,false,,,false,false,,2020-04-21T18:51:37.000Z,0
CVE-2017-18798,https://securityvulnerability.io/vulnerability/CVE-2017-18798,,"Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, D7000 before 1.0.1.50, and D1500 before 1.0.0.25.",Netgear,R6700 Firmware,8.4,HIGH,0.0005799999926239252,false,,false,false,false,,,false,false,,2020-04-21T18:35:19.000Z,0