Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-12822 State: PUBLISHED Published: 2025-01-30T13:42:07.286Z Last Updated: 2025-01-30T14:34:24.926Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: DeluxeThemes Products: Media Manager for UserPro Problem Types: CWE-862 Description: The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the add_capto_img() function in all versions up to, and including, 3.11.0. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registr
ttackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a57b2afa-b943-419f-9819-d7b6835c4d10?source=cve - https://codecanyon.net/item/media-manager-for-userpro/8664618
CVE ID: CVE-2024-12824 State: PUBLISHED Published: 2025-03-01T06:39:26.867Z Last Updated: 2025-03-03T20:57:26.989Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: Nokri – Job Board WordPress Theme Problem Types: CWE-620 Description: The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.2. This is due to the plugin not properly checking for an empty token value prior updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage
es it possible for unauthenticated attackers to change arbitrary user's password, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/60a7cce0-637f-49bd-aa4a-fd7023d99a64?source=cve - https://themeforest.net/item/nokri-job-board-wordpress-theme/22677241
CVE ID: CVE-2024-12825 State: PUBLISHED Published: 2025-02-01T07:21:37.847Z Last Updated: 2025-02-03T16:37:25.185Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: brechtvds Products: Custom Related Posts Problem Types: CWE-862 Description: The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to search posts and link/unlink relations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfen
ch posts and link/unlink relations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/40ba98a0-2193-4201-8370-34fd438dadb3?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3226283%40custom-related-posts&new=3226283%40custom-related-posts&sfp_email=&sfph_mail=
CVE ID: CVE-2024-12826 State: PUBLISHED Published: 2025-01-25T07:24:20.241Z Last Updated: 2025-01-27T15:35:56.998Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: nmedia Products: GoHero Store Customizer for WooCommerce Problem Types: CWE-862 Description: The GoHero Store Customizer for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wooh_action_settings_save_frontend() function in all versions up to, and including, 3.5. This makes it possible for unauthenticated attackers to update limited plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www
ttackers to update limited plugin settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f65ee908-004f-4526-aeca-41b36522bb30?source=cve - https://wordpress.org/plugins/personalize-woocommerce-cart-page/
CVE ID: CVE-2024-12827 State: PUBLISHED Published: 2025-06-27T08:23:57.966Z Last Updated: 2025-06-27T13:31:54.772Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: scriptsbundle Products: DWT - Directory & Listing WordPress Theme Problem Types: CWE-620 Description: The DWT - Directory & Listing WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.6. This is due to the plugin not properly checking for an empty token value prior to resetting a user's password through the dwt_listing_reset_password() function. This makes it possible for unauthenticated attackers to change arbit
through the dwt_listing_reset_password() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/51fc7d47-2a0f-4713-9859-120321aa32dc?source=cve - https://themeforest.net/item/dwt-listing-directory-listing-wordpress-theme/21976132
CVE ID: CVE-2024-12828 State: PUBLISHED Published: 2024-12-30T16:48:13.347Z Last Updated: 2024-12-30T17:35:11.375Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Webmin Products: Webmin Problem Types: CWE-78 Description: Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this
k of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1725/ - https://github.com/webmin/authentic-theme/commit/61e5b10227b50407e3c6ac494ffbd4385d1b59df
CVE ID: CVE-2024-12829 State: PUBLISHED Published: 2024-12-20T00:05:08.410Z Last Updated: 2024-12-20T17:38:11.408Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Arista Products: NG Firewall Problem Types: CWE-78 Description: Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability. The specific flaw exists within the ExecManagerImpl class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system c
ss. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24015. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1717/
CVE ID: CVE-2024-12830 State: PUBLISHED Published: 2024-12-20T00:05:18.862Z Last Updated: 2024-12-20T17:38:03.994Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Arista Products: NG Firewall Problem Types: CWE-22 Description: Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the custom_handler method. The issue results from the lack of proper validation of a user-supplied path prior to usi
of the custom_handler method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the www-data user. Was ZDI-CAN-24019. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1718/
CVE ID: CVE-2024-12831 State: PUBLISHED Published: 2024-12-20T00:05:49.863Z Last Updated: 2024-12-20T17:37:50.042Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Arista Products: NG Firewall Problem Types: CWE-863 Description: Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the uvm_login module. The issue results from incorrect authorization.
his vulnerability. The specific flaw exists within the uvm_login module. The issue results from incorrect authorization. An attacker can leverage this to escalate privileges to resources normally protected from the user. Was ZDI-CAN-24324. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1720/
CVE ID: CVE-2024-12832 State: PUBLISHED Published: 2024-12-20T00:05:34.744Z Last Updated: 2024-12-20T17:37:55.985Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: Arista Products: NG Firewall Problem Types: CWE-89 Description: Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files and disclose sensitive information on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability. The specific flaw exists within the ReportEntry class. The issue results from the lack of proper validation of a user-supplied string before
ists within the ReportEntry class. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the www-data user. Was ZDI-CAN-24325. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1719/
CVE ID: CVE-2024-12833 State: PUBLISHED Published: 2025-02-11T19:23:53.715Z Last Updated: 2025-02-12T19:11:13.548Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Paessler Products: PRTG Network Monitor Problem Types: CWE-79 Description: Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Paessler PRTG Network Monitor. Some user interaction on the part of an administrator is required to exploit this vulnerability. The specific flaw exists within the PRTG Network Monitor web interface. The issue results from the lack
vulnerability. The specific flaw exists within the PRTG Network Monitor web interface. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-23371. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1736/
CVE ID: CVE-2024-12834 State: PUBLISHED Published: 2024-12-30T16:49:00.911Z Last Updated: 2024-12-31T21:30:07.548Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DRASimuCAD Problem Types: CWE-843 Description: Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of STP files. The issue resu
isit a malicious page or open a malicious file. The specific flaw exists within the parsing of STP files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22414. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1722/
CVE ID: CVE-2024-12835 State: PUBLISHED Published: 2024-12-30T16:49:19.241Z Last Updated: 2024-12-31T21:26:56.145Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DRASimuCAD Problem Types: CWE-787 Description: Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICS files. The issue
ust visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ICS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22415. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1723/
CVE ID: CVE-2024-12836 State: PUBLISHED Published: 2024-12-30T16:50:06.133Z Last Updated: 2024-12-31T21:25:33.771Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DRASimuCAD Problem Types: CWE-843 Description: Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of STP files. The issue resu
isit a malicious page or open a malicious file. The specific flaw exists within the parsing of STP files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22450. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1724/
CVE ID: CVE-2024-12837 State: PUBLISHED Published: 2025-03-07T07:45:16.126Z Last Updated: 2025-03-07T15:10:49.823Z Vendors: Imagination Technologies Products: Graphics DDK Problem Types: CWE-416 Description: Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.imaginationtech.com/gpu-driver-vulnerabilities/
CVE ID: CVE-2024-12838 State: PUBLISHED Published: 2024-12-31T01:24:48.680Z Last Updated: 2024-12-31T15:56:46.585Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Changing Information Technology Products: CGFIDO Problem Types: CWE-302 Description: The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8332-2100f-1.html - https://www.twcert.org.tw/en/cp-13
P Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8332-2100f-1.html - https://www.twcert.org.tw/en/cp-139-8333-32cf8-2.html
CVE ID: CVE-2024-12839 State: PUBLISHED Published: 2024-12-31T01:32:11.422Z Last Updated: 2024-12-31T15:56:18.203Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Changing Information Technology Products: CGFIDO Problem Types: CWE-294 Description: The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device. Additional Analyst Notes: - CISA ADP V
ker who obtains this signature can use it to log into the system with any device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8334-8b836-1.html - https://www.twcert.org.tw/en/cp-139-8335-e4a3f-2.html
CVE ID: CVE-2024-12840 State: REJECTED Published: 2024-12-20T15:47:17.402Z Last Updated: 2025-05-12T20:16:41.146Z Description: No description available.
CVE ID: CVE-2024-12841 State: PUBLISHED Published: 2024-12-20T18:31:05.248Z Last Updated: 2024-12-24T16:59:42.813Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289077 - https://vuldb.com/?ctiid.289077 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289077 - https://vuldb.com/?ctiid.289077 - https://github.com/emlog/emlog/issues/305
CVE ID: CVE-2024-12842 State: PUBLISHED Published: 2024-12-20T20:00:13.813Z Last Updated: 2024-12-24T16:35:01.784Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289078 - https://vuldb.com/?ctiid.289078 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289078 - https://vuldb.com/?ctiid.289078 - https://github.com/emlog/emlog/issues/305
CVE ID: CVE-2024-12843 State: PUBLISHED Published: 2024-12-20T20:31:05.065Z Last Updated: 2024-12-27T14:51:46.702Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Emlog Pro up to 2.4.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/plugin.php. The manipulation of the argument filter leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289079 - https://vuldb.com/?ctiid.289079
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289079 - https://vuldb.com/?ctiid.289079 - https://github.com/emlog/emlog/issues/305
CVE ID: CVE-2024-12844 State: PUBLISHED Published: 2024-12-20T21:00:19.748Z Last Updated: 2024-12-27T14:51:03.342Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.1. Affected is an unknown function of the file /admin/store.php. The manipulation of the argument tag leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289080 - https://vuldb.com/?ctiid.289080 - https://
Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289080 - https://vuldb.com/?ctiid.289080 - https://vuldb.com/?submit.462465 - https://github.com/emlog/emlog/issues/305
CVE ID: CVE-2024-12845 State: PUBLISHED Published: 2024-12-20T21:31:04.444Z Last Updated: 2024-12-27T14:50:07.264Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic was found in Emlog Pro up to 2.4.1. Affected by this vulnerability is an unknown functionality in the library /include/lib/common.php. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289081 - https://vuldb.com/?
sed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289081 - https://vuldb.com/?ctiid.289081 - https://vuldb.com/?submit.462477 - https://github.com/emlog/emlog/issues/306
CVE ID: CVE-2024-12846 State: PUBLISHED Published: 2024-12-21T05:00:11.038Z Last Updated: 2024-12-27T14:49:33.599Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: Emlog Pro Problem Types: CWE-79, CWE-94 Description: A vulnerability, which was classified as problematic, has been found in Emlog Pro up to 2.4.1. Affected by this issue is some unknown functionality of the file /admin/link.php. The manipulation of the argument siteurl/icon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289082 - https://vu
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.289082 - https://vuldb.com/?ctiid.289082 - https://vuldb.com/?submit.462614 - https://github.com/emlog/emlog/issues/307
CVE ID: CVE-2024-12847 State: PUBLISHED Published: 2025-01-10T19:36:36.675Z Last Updated: 2025-11-22T12:23:43.932Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: NETGEAR Products: DGN1000 Problem Types: CWE-78, CWE-306 Description: NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can execute arbitrary operating system commands as root by sending crafted HTTP requests to the setup.cgi endpoint. This vulnerability has been exploited in the wild since at least 2017 and specifically by the Shadowserver Foundation on 2025-02-06 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment:
17 and specifically by the Shadowserver Foundation on 2025-02-06 UTC. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://seclists.org/bugtraq/2013/Jun/8 - https://www.exploit-db.com/exploits/25978 - https://www.exploit-db.com/exploits/43055 - https://vulncheck.com/advisories/netgear-dgn