PT-2024-9318 · NetGear · Netgear R7000

Published 2024-02-21 · Updated 2024-10-16 · CVE-2024-35520

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions: Netgear R7000 version 1.0.11.136

Description: The issue is related to a Command Injection vulnerability in the RMT invite.cgi script, specifically via the device name2 parameter. This vulnerability can be exploited by a remote attacker to execute arbitrary commands. The vulnerability is due to the lack of proper data sanitization at the management level when processing the device name2 parameter.

Recommendations: For Netgear R7000 version 1.0.11.136, as a temporary workaround, consider disabling the RMT invite.cgi script until a patch is available. Restrict access to the device name2 parameter in the RMT invite.cgi script to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-11008

CVE-2024-35520

Affected Products

Netgear R7000

References · 9

• https://bdu.fstec.ru/vul/2024-11008 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35520 · Security Note
• https://vuldb.com/?id.280334 · Note
• https://twitter.com/CveFindCom/status/1845940611448185117 · Twitter Post
• https://t.me/cvedetector/7869 · Telegram Post
• https://twitter.com/CVEnew/status/1845940059469762679 · Twitter Post
• https://twitter.com/SecuriTricks/status/1846128516816875750 · Twitter Post
• https://kb.netgear.com/000066027/Security-Advisory-for-Post-Authentication-Command-Injection-on-the-R7000-PSV-2023-0154 · Note