PT-2024-8370 · NetGear · Netgear R8500

Published 2024-11-05 · Updated 2024-11-05 · CVE-2024-51000

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netgear R8500 version 1.0.2.160

Description The issue is related to multiple stack overflow vulnerabilities in the wireless.cgi component of the Netgear R8500 router's firmware. These vulnerabilities are caused by uncontrolled copying of user input when handling the opmode, opmode an, and opmode an 2 parameters. This allows attackers to cause a Denial of Service (DoS) via a crafted POST request to the "wireless.cgi" endpoint.

Recommendations For Netgear R8500 version 1.0.2.160, consider disabling the wireless.cgi component or restricting access to it until a patch is available. Avoid using the opmode, opmode an, and opmode an 2 parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-09929

CVE-2024-51000

Affected Products

Netgear R8500

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-51000 · Security Note
• https://netgear.com/about/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51000 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09929 · Security Note
• https://twitter.com/CVEnew/status/1853818883498557467 · Twitter Post
• ❌ https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_35/35.md · Note, Deleted
• https://github.com/advisories/GHSA-gw9j-jrgv-94wc · Note