CVE-2024-54805

Name of the Vulnerable Software and Affected Versions Netgear WNR854T version 1.5.2

Description The issue allows an attacker to perform Command Injection. This can be achieved by sending a specially crafted request to the "post.cgi" endpoint, updating the get email parameter in nvram. After updating this parameter, an attacker can visit the "send log.cgi" endpoint, which uses the parameter in a system call, allowing command execution.

Recommendations For Netgear WNR854T version 1.5.2, as a temporary workaround, consider restricting access to the "post.cgi" and "send log.cgi" endpoints until a patch is available. Avoid using the get email parameter in the "post.cgi" endpoint until the issue is resolved.