Veille CVE
CVE-2016-1555
9.8 Critique Exploitée activementCatalogue CISA KEV — NETGEAR Multiple WAP Devices Command Injection Vulnerability
Ajoutée le 25/03/2022 · Échéance de correction (agences US) : 15/04/2022
Action requise : Apply updates per vendor instructions.
Description
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 10.0 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/112 Mailing ListThird Party Advisory
- https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic PatchVendor Advisory
- https://www.exploit-db.com/exploits/45909/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/135956/D-Link-Netgear-FIRMADYNE-Command-Injection-Buffer-Overflow.html Third Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2016/Feb/112 Mailing ListThird Party Advisory
- https://kb.netgear.com/30480/CVE-2016-1555-Notification?cid=wmt_netgear_organic PatchVendor Advisory
- https://www.exploit-db.com/exploits/45909/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1555 US Government Resource