Xr1000v2 Firmware
Monthly
NETGEAR XR1000v2 routers are vulnerable to OS command injection through inadequate input validation, enabling attackers with LAN access to execute arbitrary commands with elevated privileges. The vulnerability affects authenticated users on the local network and could allow complete router compromise including data interception and network manipulation. A patch is available.
Cross-site request forgery in NETGEAR's XR500, XR1000, and XR1000v2 gaming routers allows an adjacent-network attacker to tamper with router configuration and disrupt operations by tricking a logged-in administrator into visiting a malicious page. The vulnerability stems from absent or insufficient CSRF protections on the router's web management interface, enabling forged requests to be submitted on behalf of an authenticated admin. No confidentiality impact is present; exploitation requires both social engineering success and admin-session timing, but can result in full configuration integrity loss and service disruption. No public exploit or CISA KEV listing is identified at time of analysis.
NETGEAR XR1000v2 routers are vulnerable to OS command injection through inadequate input validation, enabling attackers with LAN access to execute arbitrary commands with elevated privileges. The vulnerability affects authenticated users on the local network and could allow complete router compromise including data interception and network manipulation. A patch is available.
Cross-site request forgery in NETGEAR's XR500, XR1000, and XR1000v2 gaming routers allows an adjacent-network attacker to tamper with router configuration and disrupt operations by tricking a logged-in administrator into visiting a malicious page. The vulnerability stems from absent or insufficient CSRF protections on the router's web management interface, enabling forged requests to be submitted on behalf of an authenticated admin. No confidentiality impact is present; exploitation requires both social engineering success and admin-session timing, but can result in full configuration integrity loss and service disruption. No public exploit or CISA KEV listing is identified at time of analysis.