CVE-2024-51021

Name of the Vulnerable Software and Affected Versions Netgear XR300 version 1.0.3.78 Netgear R7000P version 1.3.3.154 Netgear R6400 v2 version 1.0.4.128

Description The issue is related to a command injection vulnerability via the wan gateway parameter at the genie fix2.cgi endpoint. This allows attackers to execute arbitrary OS commands via a crafted request. The vulnerability is associated with the failure to neutralize special elements used in the operating system command when processing the wan gateway parameter. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary commands.

Recommendations For Netgear XR300 version 1.0.3.78, consider disabling access to the genie fix2.cgi endpoint until a patch is available. For Netgear R7000P version 1.3.3.154, restrict the use of the wan gateway parameter in the genie fix2.cgi endpoint to minimize the risk of exploitation. For Netgear R6400 v2 version 1.0.4.128, avoid using the wan gateway parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.