Vulnerabilities > Netgear > Nighthawk X10 R9000 Firmware > 1.0.4.24

DATE CVE VULNERABILITY TITLE RISK
2020-02-24 CVE-2019-12511 OS Command Injection vulnerability in Netgear Nighthawk X10-R9000 Firmware 1.0.4.24
In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC.
network
netgear CWE-78
critical
 9.3
9.3
2020-02-24 CVE-2019-12510 Insufficient Verification of Data Authenticity vulnerability in Netgear Nighthawk X10-R9000 Firmware 1.0.4.24
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplying a malicious X-Forwarded-For header of the device's LAN IP address (192.168.1.1) in every request.
network
low complexity
netgear CWE-345
6.4
6.4