PT-2024-8543 · NetGear · Netgear R7000P

Published 2024-10-28 · Updated 2025-05-02 · CVE-2024-51015

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netgear R7000P version 1.3.3.154

Description The issue is related to a command injection vulnerability via the device name2 parameter at the "operation mode.cgi" endpoint. This allows attackers to execute arbitrary OS commands via a crafted request. The vulnerability is also described as a stack-based buffer overflow when handling the device name2 parameter, which can be exploited by a remote attacker to execute arbitrary commands.

Recommendations For Netgear R7000P version 1.3.3.154, consider disabling access to the "operation mode.cgi" endpoint until a patch is available. Avoid using the device name2 parameter in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-10110

CVE-2024-51015

Affected Products

Netgear R7000P

References · 8

• https://netgear.com/about/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-51015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51015 · Security Note
• https://bdu.fstec.ru/vul/2024-10110 · Security Note
• https://twitter.com/CVEnew/status/1853818901584310328 · Twitter Post
• ❌ https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_62/62.md · Note, Deleted
• https://t.me/cvenotify/120647 · Telegram Post
• https://github.com/advisories/GHSA-wg7j-6r9g-jjch · Note