NETGEAR Nighthawk x10-r9000 Firmware vulnerabilities

4 CVEs affecting NETGEAR Nighthawk x10-r9000 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-12513, published 2020-02-24.

More from NETGEAR.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-12511, published 2020-02-24. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at…
• CVE-2019-12512, published 2020-02-24. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login…
• CVE-2019-12513, published 2020-02-24. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname field, an attacker may execute stored XSS attacks against this device. When the…
• CVE-2019-12510, published 2020-02-24. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplying a malicious X-Forwarded-For…