NETGEAR · Wireless Access Point (WAP) Devices
CVE-2016-1555
NETGEAR Multiple WAP Devices Command Injection Vulnerability
O que é
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
CISA: Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 15 de abril de 2022
Mais falhas exploradas de NETGEAR
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 8 de set. de 2022 | Exposure of Sensitive Information | Multiple Devices | Alto 8,1 | 89% |
| 8 de jun. de 2022 | Buffer Overflow | Multiple Devices | Crítica 9,8 | 46% |
| 25 de mar. de 2022 | OS Command Injection | DGN2200 Devices | Alto 8,8 | 73% |
| 25 de mar. de 2022 | Buffer Overflow | WNR2000v5 Router | Crítica 9,8 | 83% |
| 7 de mar. de 2022 | Remote Code Execution | Multiple Routers | Alto 8,8 | 99,8% |
| 7 de mar. de 2022 | DGN2200 Remote Code Execution | Wireless Router DGN2200 | Crítica 9,8 | 69% |
| 3 de nov. de 2021 | Missing Function Level Access Control | JGS516PE Devices | Crítica 9,8 | 57% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.