PT-2024-8387 · NetGear · Netgear R8500+1

Published 2024-10-28 · Updated 2024-11-06 · CVE-2024-51004

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netgear R8500 version 1.0.2.160 Netgear R7000P version 1.3.3.154

Description The issue is related to multiple stack overflow vulnerabilities in the usb device.cgi component of Netgear routers. These vulnerabilities can be exploited via the cifs user, read access, and write access parameters, allowing attackers to cause a Denial of Service (DoS) via a crafted POST request to the /usb device.cgi endpoint.

Recommendations For Netgear R8500 version 1.0.2.160, consider disabling the usb device.cgi component until a patch is available. For Netgear R7000P version 1.3.3.154, restrict access to the usb device.cgi component to minimize the risk of exploitation. Avoid using the parameters cifs user, read access, and write access in the affected API endpoint until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-09946

CVE-2024-51004

Affected Products

Netgear R7000P

Netgear R8500

References · 9

• https://netgear.com/about/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51004 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09946 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-51004 · Security Note
• https://github.com/advisories/GHSA-jcvh-w2rh-mxx9 · Note
• https://twitter.com/VulmonFeeds/status/1853955809404747916 · Twitter Post
• https://twitter.com/CVEnew/status/1853818888451981481 · Twitter Post
• ❌ https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_51/51.md · Note, Deleted
• https://vuldb.com/es/?product.netgear:r8500 · Note