PT-2024-9998 · NetGear · Netgear R6900P
Upload
+1
·
Published
2024-11-25
·
Updated
2025-01-14
·
CVE-2024-12147
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
Netgear R6900 version 1.0.1.26 1.0.20
Description:
A critical vulnerability has been found in the Netgear R6900 router, affecting an unknown functionality of the file upgrade check.cgi in the HTTP Header Handler component. The manipulation of the
Content-Length argument leads to a buffer overflow. This issue can be exploited remotely, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability has been publicly disclosed and may be exploited. It only affects products that are no longer supported by the maintainer.Recommendations:
For Netgear R6900 version 1.0.1.26 1.0.20, as a temporary workaround, consider disabling the
upgrade check.cgi file until a patch is available. Restrict access to the HTTP Header Handler component to minimize the risk of exploitation. Avoid using the Content-Length argument in the affected HTTP endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Netgear R6900P