PT-2024-8677 · NetGear · Netgear Dgn1000

Nop3Z · Published 2024-08-23 · Updated 2024-08-27 · CVE-2024-42756

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netgear DGN1000WW version 1.1.00.45

Description The issue in Netgear DGN1000WW allows a remote attacker to execute arbitrary code via the Diagnostics page. This is related to incorrect code generation management. Exploitation of the issue may allow an attacker to execute arbitrary commands.

Recommendations For Netgear DGN1000WW version 1.1.00.45, upgrade to version 1.1.00.46 to mitigate the risks. As a temporary workaround, consider restricting access to the Diagnostics page until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-10279

CVE-2024-42756

Affected Products

Netgear Dgn1000

References · 10

• 🔥 https://github.com/Nop3z/CVE/blob/main/Netgear/Netgear%20DGN1000%20RCE/Netgear%20DGN1000%20RCE.md · Exploit
• https://bdu.fstec.ru/vul/2024-10279 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-42756 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42756 · Vendor Advisory
• https://t.me/cvedetector/4010 · Telegram Post
• https://twitter.com/cracbot/status/1828673954602750005 · Twitter Post
• https://netgear.com/about/security · Note
• https://twitter.com/VulmonFeeds/status/1827071862196629861 · Twitter Post
• https://twitter.com/transilienceai/status/1828375283084284340 · Twitter Post
• https://twitter.com/CVEnew/status/1827010736448790994 · Twitter Post