CVE-2024-51010

Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:netgear:r8500_firmware:1.0.2.160:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r8500:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netgear:xr300_firmware:1.0.3.78:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr300:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netgear:r7000p_firmware:1.3.3.154:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netgear:r6400v2_firmware:1.0.4.128:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r6400v2:-:*:*:*:*:*:*:*

History

21 May 2025, 19:59

Type Values Removed Values Added
Summary
  • (es) Se descubrió que Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154 y R6400 v2 1.0.4.128 contienen una vulnerabilidad de inyección de comandos en el componente ap_mode.cgi a través del parámetro apmode_gateway. Esta vulnerabilidad permite a los atacantes ejecutar comandos arbitrarios del sistema operativo a través de una solicitud manipulada.
First Time Netgear xr300
Netgear r6400v2
Netgear r8500 Firmware
Netgear r6400v2 Firmware
Netgear
Netgear r7000p
Netgear r8500
Netgear xr300 Firmware
Netgear r7000p Firmware
References () https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md - () https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md - Broken Link
References () https://www.netgear.com/about/security/ - () https://www.netgear.com/about/security/ - Vendor Advisory
CPE cpe:2.3:h:netgear:xr300:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r8500_firmware:1.0.2.160:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r8500:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r6400v2_firmware:1.0.4.128:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r7000p_firmware:1.3.3.154:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xr300_firmware:1.0.3.78:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r6400v2:-:*:*:*:*:*:*:*

05 Nov 2024, 16:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.0
CWE CWE-78

05 Nov 2024, 15:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-11-05 15:15

Updated : 2025-05-21 19:59


NVD link : CVE-2024-51010

Mitre link : CVE-2024-51010

CVE.ORG link : CVE-2024-51010


JSON object : View

Products Affected

netgear

  • r8500_firmware
  • xr300_firmware
  • r8500
  • r7000p_firmware
  • r6400v2
  • r6400v2_firmware
  • r7000p
  • xr300
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')