NETGEAR WNR854T Firmware vulnerabilities

9 CVEs affecting NETGEAR WNR854T Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-54809, published 2025-03-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-54807, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient parameter of the AddPortMapping SOAPAction…
CVE-2024-54805, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter get_email. After which, they can…
CVE-2024-54804, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter wan_hostname and forcing a reboot.…
CVE-2024-54803, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter pppoe_peer_mac and forcing a…
CVE-2024-54806, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface.
CVE-2017-18855, published 2020-04-29. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. NETGEAR WNR854T devices before 1.5.2 are affected by command execution.
CVE-2024-54808, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained use of sscanf. The vulnerability allows…
CVE-2024-54802, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header.
CVE-2024-54809, published 2025-03-31. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header parameter in a strncpy where size is…