PT-2024-8389 · NetGear · Netgear R7000P

Published 2024-10-28 · Updated 2025-05-02 · CVE-2024-51013

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netgear R7000P version 1.3.3.154

Description The issue is related to a stack overflow vulnerability in the wireless.cgi script of the NETGEAR R7000P router's firmware, specifically when handling the RADIUSAddr%d wla parameter. This can be exploited by sending a specially crafted POST request to cause a Denial of Service (DoS).

Recommendations For Netgear R7000P version 1.3.3.154, consider disabling access to the wireless.cgi script until a patch is available to prevent exploitation of the RADIUSAddr%d wla parameter. Restricting access to this script can help minimize the risk of a Denial of Service (DoS) attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-09948

CVE-2024-51013

Affected Products

Netgear R7000P

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-51013 · Security Note
• https://netgear.com/about/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51013 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09948 · Security Note
• https://github.com/advisories/GHSA-w2rm-ghcp-rwrp · Note
• https://twitter.com/VulmonFeeds/status/1853935329595592988 · Twitter Post
• ❌ https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_64/64.md · Note, Deleted
• https://t.me/cvenotify/120645 · Telegram Post
• https://twitter.com/CVEnew/status/1853818899252367490 · Twitter Post