NETGEAR RAX120 V1.2.5.18 SOAP InstallApp command injection disclosed
Original title: [0day-rubbish] NETGEAR RAX120 V1.2.5.18 authenticated SOAP InstallApp OS command injection to root-configured web-stack execution (6.8 Medium; conditionally 7.2 High with management exposure)
An authenticated request can reach OS command execution in the router's root-configured web stack.
0day Rubbish Research Team publicly disclosed a vulnerability in NETGEAR RAX120 (Nighthawk AX12) firmware V1.2.5.18. The flaw is an authenticated SOAP InstallApp OS command injection that leads to execution in the root-configured web stack. The team rates it 6.8 Medium, or 7.2 High if management is exposed. No fix or exploitation status is stated.
Unconfirmed: No patch, CVE, or confirmed exploitation is stated in the snippet.
- The affected firmware is NETGEAR RAX120 V1.2.5.18.
- The administrative web plane uses lighttpd and /usr/sbin/net-cgi.
- The router is built on the Qualcomm IPQ8074 platform.
- The rating rises to 7.2 High with management exposure.
Impact: authenticated OS command injection in the web stack
| Product | Affected |
|---|---|
| NETGEAR RAX120 | V1.2.5.18 |
- Vendors
- NETGEAR
- Products
- RAX120Nighthawk AX12
- Organizations
- 0day Rubbish Research Team
- Countries
- United States
From the original article
Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in NETGEAR RAX120 (Nighthawk AX12) firmware V1. 2. 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.