PT-2025-29578 · NetGear · Netgear Xr300

Published 2025-07-15 · Updated 2025-08-11 · CVE-2025-52080

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Netgear XR300 version 1.0.3.38 10.3.30

Description A stack-based buffer overflow exists in the HTTPD service through the usb device.cgi endpoint when processing POST requests containing the share name parameter.

Recommendations Apply updates to address the issue in the HTTPD service. As a temporary workaround, restrict access to the usb device.cgi endpoint. Avoid sending POST requests with excessively long share name parameters to the usb device.cgi endpoint.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2025-09961

CVE-2025-52080

Affected Products

Netgear Xr300

References · 8

• 🔥 https://github.com/lafdrew/IOT/blob/main/Netgear%20XR300/share_name%20of%20usb_device.cgi/buffer%20overflow%20in%20share_neme%20of%20usb_device.cgi.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-52080 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52080 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09961 · Security Note
• https://twitter.com/CVEnew/status/1945156658365145572 · Twitter Post
• https://t.me/cvetracker/27873 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1945189974078283917 · Twitter Post
• https://t.me/cveNotify/131720 · Telegram Post