Netgear R8500 1.0.2.160/1.3.3.154 POST Request usb_device.cgi cifs_user/read_access/write_access stack-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in Netgear R8500 1.0.2.160/1.3.3.154. This impacts an unknown function of the file usb_device.cgi of the component POST Request Handler. Such manipulation of the argument cifs_user/read_access/write_access leads to stack-based overflow. This vulnerability is referenced as CVE-2024-51004. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Netgear R8500 1.0.2.160/1.3.3.154. Affected by this issue is an unknown part of the file usb_device.cgi of the component POST Request Handler. The manipulation of the argument cifs_user/read_access/write_access with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. CVE summarizes:

Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb_device.cgi via the cifs_user, read_access, and write_access parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.

The advisory is shared for download at netgear.com. This vulnerability is handled as CVE-2024-51004 since 10/28/2024. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 11/05/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Wireless LAN Software

Vendor

• Netgear

Name

• R8500

Version

• 1.0.2.160
• 1.3.3.154

License

• commercial

Website

• Vendor: https://www.netgear.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion