PT-2024-7220 · NetGear · Netgear Xr1000

Published 2024-02-21 · Updated 2024-11-08 · CVE-2024-35517

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Netgear XR1000 version 1.0.0.64

Description The issue is related to a lack of input sanitization in the usb remote smb conf.cgi script of the NETGEAR XR1000 Wi-Fi router's firmware. This can be exploited by a remote attacker to execute arbitrary commands using the share name parameter.

Recommendations For Netgear XR1000 version 1.0.0.64, update to the latest firmware version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to the vulnerable usb remote smb conf.cgi script until a patch is available. Avoid using the share name parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-08559

CVE-2024-35517

Affected Products

Netgear Xr1000

References · 11

• 🔥 https://github.com/consrc/cves/blob/main/CVE-2024-35517.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-35517 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35517 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08559 · Security Note
• https://kb.netgear.com/000066029/Security-Advisory-for-Post-Authentication-Command-Injection-on-the-XR1000-PSV-2023-0152 · Note
• https://twitter.com/transilienceai/status/1845874430779810073 · Twitter Post
• https://t.me/cvenotify/101144 · Telegram Post
• https://t.me/cvedetector/7754 · Telegram Post
• https://twitter.com/transilienceai/status/1845874443329196474 · Twitter Post
• https://link.springer.com/chapter/10.1007/978-3-031-64171-8_21 · Note
• https://twitter.com/transilienceai/status/1845874416737296387 · Twitter Post