PT-2024-9811 · NetGear · Netgear R8500

Published 2024-10-28 · Updated 2024-11-05 · CVE-2024-51006

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160

Description: The issue is related to a stack overflow in the ipv6 tunnel function when handling the ipv6 static ip parameter. This can be exploited by a remote attacker to cause a Denial of Service (DoS) using a crafted POST request to the / endpoint, although the exact endpoint is not specified.

Recommendations: For Netgear R8500 version 1.0.2.160, consider disabling the ipv6 tunnel function as a temporary workaround until a patch is available. Restrict access to the ipv6 static ip parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-11587

CVE-2024-51006

Affected Products

Netgear R8500

References · 9

• https://netgear.com/about/security · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-51006 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51006 · Vendor Advisory
• https://twitter.com/CVEnew/status/1853818890851078228 · Twitter Post
• https://github.com/advisories/GHSA-cmv3-c9g2-j3g5 · Note
• ❌ https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_46/46.md · Note, Deleted
• https://vuldb.com/es/?product.netgear:r8500 · Note
• https://twitter.com/VulmonFeeds/status/1853914850151330160 · Twitter Post