NETGEAR XR300 Firmware vulnerabilities

57 CVEs affecting NETGEAR XR300 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-40620, published 2026-01-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-27643, published 2023-03-29. High severity, CVSS 8.8. EPSS: 25.2% chance of exploitation in the next 30 days. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this…
CVE-2021-34991, published 2021-11-15. High severity, CVSS 8.8. EPSS: 5.7% chance of exploitation in the next 30 days. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this…
CVE-2022-40619, published 2026-01-28. High severity, CVSS 7.7. EPSS: 2.5% chance of exploitation in the next 30 days. FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This interface is vulnerable to…
CVE-2021-45612, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68,…
CVE-2021-45622, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68,…
CVE-2021-45617, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, EAX20 before 1.0.0.48, EAX80 before 1.0.1.64, EX7500 before 1.0.0.72,…
CVE-2021-45621, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68,…
CVE-2021-45620, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68,…
CVE-2021-38528, published 2021-08-11. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6900P before 1.3.2.132, R7000P before 1.3.2.132, R7100LG before…
CVE-2021-45624, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.66, D8500 before 1.0.3.58, R7000 before 1.0.11.110, R7100LG before…

Latest

CVE-2022-40620, published 2026-01-28. High severity, CVSS 7.7. EPSS: 0.3% chance of exploitation in the next 30 days. FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update packages through its auto-update mechanism.…
CVE-2025-52082, published 2025-07-15. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests containing…
CVE-2025-52081, published 2025-07-15. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests…
CVE-2025-52080, published 2025-07-15. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service through the usb_device.cgi endpoint. The vulnerability occurs when processing POST requests…
CVE-2024-52026, published 2024-11-05. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at bsw_pppoe.cgi. This vulnerability allows attackers to…
CVE-2024-52025, published 2024-11-05. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at geniepppoe.cgi. This vulnerability allows attackers to…
CVE-2024-52024, published 2024-11-05. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at wizpppoe.cgi. This vulnerability allows attackers to…
CVE-2024-52023, published 2024-11-05. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe2.cgi. This vulnerability allows attackers to…
CVE-2024-52022, published 2024-11-05. High severity, CVSS 8.0. EPSS: 1% chance of exploitation in the next 30 days. Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway…