Netgear Xr1000 Firmware vulnerabilities

CVE-2021-45613 [CRITICAL] CWE-77 CVE-2021-45613: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, D7000v2 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, MR80 before 1.1.2.20, MS80 before 1.1.2.20, RAX15 before 1.0.3.96, RAX20 before 1.0.

CVE-2021-45614 [CRITICAL] CWE-77 CVE-2021-45614: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, RAX15 before 1.0.3.96, RAX20 before 1.0.3.96, RAX200 before 1.0.4.120, RAX45 before 1.0.3.96, RAX50 before 1.0.3.96, RAX43 before

CVE-2021-45612 [CRITICAL] CWE-77 CVE-2021-45612: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68, EX7500 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, R6400v2 before 1.0.4.118, R6700v3 befor

CVE-2021-45622 [CRITICAL] CWE-77 CVE-2021-45622: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68, EX7500 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, R6400 before 1.0.1.70, R6400v2 before 1

CVE-2021-45616 [CRITICAL] CWE-77 CVE-2021-45616: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 3.2.18.2, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, R6900P before 1.3.3.140, R7000 before 1.0.11.126, R7000P before 1.3.3.140, R7850 before 1.0.5.68, R7900 before 1.0.4.46, R7900P bef

CVE-2021-45620 [CRITICAL] CWE-77 CVE-2021-45620: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68, LAX20 before 1.1.6.28, MR60 before 1.0.6.116, MR80 before 1.1.2.20, MS60 before 1.0.6.116, MS80 before 1.1.2.20, MK62 before 1.0.6.116, MK83 before 1.1.2.2

CVE-2021-45621 [CRITICAL] CWE-77 CVE-2021-45621: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affec Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68, EX3700 before 1.0.0.94, EX3800 before 1.0.0.94, EX6120 before 1.0.0.64, EX6130 before 1.0.0.44, EX7000 before 1.0.1.104, EX7500 before 1.0.0.74, LAX20 bef

CVE-2021-34982 [HIGH] CWE-121 CVE-2021-34982: NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which lis

CVE-2021-45513 [CRITICAL] CWE-77 CVE-2021-45513: NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attac NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attacker.

CVE-2024-35517 [HIGH] CWE-77 CVE-2024-35517: Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.

CVE-2021-45514 [HIGH] CWE-77 CVE-2021-45514: NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attac NETGEAR XR1000 devices before 1.0.0.58 are affected by command injection by an unauthenticated attacker.

CVE-2021-45510 [HIGH] CVE-2021-45510: NETGEAR XR1000 devices before 1.0.0.58 are affected by authentication bypass. NETGEAR XR1000 devices before 1.0.0.58 are affected by authentication bypass.

CVE-2026-9213 [HIGH] CWE-20 CVE-2026-9213: A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercep A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.

CVE-2021-45522 [HIGH] CWE-798 CVE-2021-45522: NETGEAR XR1000 devices before 1.0.0.58 are affected by a hardcoded password. NETGEAR XR1000 devices before 1.0.0.58 are affected by a hardcoded password.

CVE-2026-11739 [MEDIUM] CWE-78 CVE-2026-11739: A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-ad A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the affected device.

CVE-2021-45654 [HIGH] CWE-200 CVE-2021-45654: NETGEAR XR1000 devices before 1.0.0.58 are affected by disclosure of sensitive information. NETGEAR XR1000 devices before 1.0.0.58 are affected by disclosure of sensitive information.

CVE-2021-34983 [MEDIUM] CWE-306 CVE-2021-34983: NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure V NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within

CVE-2021-45549 [MEDIUM] CWE-77 CVE-2021-45549: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects LAX Certain NETGEAR devices are affected by command injection by an authenticated user. This affects LAX20 before 1.1.6.28, MK62 before 1.1.6.122, MR60 before 1.1.6.122, MS60 before 1.1.6.122, R6400v2 before 1.0.4.118, R6700v3 before 1.0.4.118, R6900P before 1.3.3.140, R7000 before 1.0.11.116, R7000P before 1.3.3.140, R7850 before 1.0.5.68, R7900 before

CVE-2026-11735 [MEDIUM] CWE-121 CVE-2026-11735: A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authentica A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.

CVE-2026-11736 [MEDIUM] CWE-20 CVE-2026-11736: A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.