PT-2024-8264 · NetGear · Netgear R7000P

Published 2024-11-05 · Updated 2024-11-05 · CVE-2024-51020

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netgear R7000P version 1.3.3.154

Description The issue is related to a stack overflow vulnerability in the usbISP detail edit.cgi script, specifically via the apn parameter. This vulnerability can be exploited by sending a crafted POST request, allowing attackers to cause a Denial of Service (DoS). The vulnerability is due to a buffer copy without checking the size of the input data when handling the apn parameter.

Recommendations For Netgear R7000P version 1.3.3.154, consider disabling access to the usbISP detail edit.cgi script or restricting the use of the apn parameter until a patch is available. Avoid using the apn parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-09817

CVE-2024-51020

Affected Products

Netgear R7000P

References · 6

• https://osv.dev/vulnerability/CVE-2024-51020 · Vendor Advisory
• https://netgear.com/about/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51020 · Security Note
• https://bdu.fstec.ru/vul/2024-09817 · Security Note
• ❌ https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_63/63.md · Note, Deleted
• https://twitter.com/CVEnew/status/1853818907674517577 · Twitter Post