Xr300 Firmware (Netgear) - vulnerabilities (CVEs)

59 CVEs, 0 in the last 30 days, 15 known versions, newest CVE from 2026-01-28. Vendor: Netgear.

CVEs of Xr300 Firmware

CVE-2022-40620 - CVSS 7.7 (high), 2026-01-28: FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update…
CVE-2022-40619 - CVSS 7.7 (high), 2026-01-28: FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This…
CVE-2025-52080 - CVSS 6.5 (medium), 2025-07-15: In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The…
CVE-2025-52082 - CVSS 6.5 (medium), 2025-07-15: In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs…
CVE-2025-52081 - CVSS 6.5 (medium), 2025-07-15: In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The…
CVE-2024-52024 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at wizpppoe.cgi.…
CVE-2024-52023 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe2.cgi.…
CVE-2024-52026 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at…
CVE-2024-52022 - CVSS 8 (high), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the…
CVE-2024-52025 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at…
CVE-2024-52014 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip…
CVE-2024-52017 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wireless_main.cgi. This vulnerability allows…
CVE-2024-52021 - CVSS 8 (high), 2024-11-05: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at bsw_fix.cgi. This vulnerability allows…
CVE-2024-52013 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip…
CVE-2024-52016 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the…
CVE-2024-52020 - CVSS 8 (high), 2024-11-05: Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at wiz_fix2.cgi. This vulnerability allows…
CVE-2024-52015 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip…
CVE-2024-52018 - CVSS 8 (high), 2024-11-05: Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at genie_dyn.cgi. This vulnerability allows…
CVE-2024-51016 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the addName%d parameter in usb_approve.cgi. This vulnerability allows attackers to…
CVE-2024-51014 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid_an parameter in bridge_wireless_main.cgi. This vulnerability allows attackers…
CVE-2024-51022 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid parameter in bridge_wireless_main.cgi. This vulnerability allows attackers to…
CVE-2024-51021 - CVSS 8 (high), 2024-11-05: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injection vulnerability via the wan_gateway parameter…
CVE-2024-51003 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the…
CVE-2024-51010 - CVSS 8 (high), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the…
CVE-2024-51002 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the l2tp_user_ip…
CVE-2024-51008 - CVSS 8 (high), 2024-11-05: Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at wiz_dyn.cgi. This vulnerability allows…
CVE-2024-51007 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi. This vulnerability allows attackers to cause…
CVE-2024-51011 - CVSS 5.7 (medium), 2024-11-05: Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe.cgi.…
CVE-2024-50996 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpa_server parameter…
CVE-2024-50997 - CVSS 5.7 (medium), 2024-11-05: Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip…
CVE-2021-34983 - CVSS 6.5 (medium), 2024-05-07: NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerability. This vulnerability allows network-adjacent…
CVE-2021-34982 - CVSS 8.8 (high), 2024-05-07: NETGEAR Multiple Routers httpd Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to…
CVE-2023-36499 - CVSS 8.8 (high), 2023-08-07: Netgear XR300 v1.0.3.78 was discovered to contain multiple buffer overflows via the wla_ssid and wlg_ssid parameters at genie_ap_wifi_change.cgi.
CVE-2022-27643 - CVSS 8.8 (high), 2023-03-29: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers.…
CVE-2021-45639 - CVSS 6.1 (medium), 2021-12-26: Certain NETGEAR devices are affected by reflected XSS. This affects CBR40 before 2.5.0.10, EAX20 before 1.0.0.32, EAX80 before 1.0.1.62, EX6120 before…
CVE-2021-45611 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects DC112A before 1.0.0.52, R6400 before 1.0.1.68, RAX200…
CVE-2021-45620 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20…
CVE-2021-45624 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.66, D8500 before 1.0.3.58, R7000…
CVE-2021-45610 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D6220 before 1.0.0.66, D6400 before 1.0.0.100, D7000v2…
CVE-2021-45617 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, EAX20 before 1.0.0.48, EAX80…
CVE-2021-45622 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20…
CVE-2021-45609 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6250 before 1.0.4.48, R7000…
CVE-2021-45612 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20…
CVE-2021-45621 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, EAX20…
CVE-2021-45625 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects XR300 before 1.0.3.68, R7000P before 1.3.3.140, and…
CVE-2021-45605 - CVSS 8.8 (high), 2021-12-26: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6400 before 1.0.1.68, R7000 before 1.0.11.116,…
CVE-2021-45527 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D6220 before 1.0.0.68, D6400 before 1.0.0.102, D7000v2 before…
CVE-2021-45512 - CVSS 9.8 (critical), 2021-12-26: Certain NETGEAR devices are affected by weak cryptography. This affects D7000v2 before 1.0.0.62, D8500 before 1.0.3.50, EX3700 before 1.0.0.84, EX3800 before…
CVE-2021-34991 - CVSS 8.8 (high), 2021-11-15: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers.…
CVE-2021-38528 - CVSS 9.8 (critical), 2021-08-11: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6900P before 1.3.2.132, R7000P…
CVE-2021-38517 - CVSS 7.2 (high), 2021-08-11: Certain NETGEAR devices are affected by out-of-bounds reads and writes. This affects R6400 before 1.0.1.70, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120,…
CVE-2021-27239 - CVSS 8.8 (high), 2021-03-29: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98…
CVE-2021-29068 - CVSS 9.9 (critical), 2021-03-23: Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.98, R6400v2 before 1.0.4.98, R7000…
CVE-2020-35796 - CVSS 9.8 (critical), 2020-12-30: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects CBR40 before 2.5.0.10, D6220 before 1.0.0.60, D6400…
CVE-2020-35795 - CVSS 9.8 (critical), 2020-12-30: Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600…
CVE-2020-35800 - CVSS 9.4 (critical), 2020-12-30: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600…
CVE-2020-35798 - CVSS 9.3 (critical), 2020-12-30: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700v3 before 1.0.4.84,…
CVE-2020-28373 - CVSS 8.8 (high), 2020-11-09: upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2…
CVE-2020-13245 - CVSS 5.9 (medium), 2020-05-28: Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120,…