{"vulnerability": "cve-2021-31802", "sightings": [{"uuid": "d8fab14d-0d6e-4d78-b6de-7d3584ca0090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "776891a0-1a27-42f7-bab4-45fa386d94bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:37.000000Z"}, {"uuid": "0b641f8b-7028-44fb-bcd9-951821ee28d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb", "content": "", "creation_timestamp": "2021-07-29T13:34:49.000000Z"}, {"uuid": "ff4e7b56-b529-4048-b903-1539e236b213", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "published-proof-of-concept", "source": "https://t.me/cKure/5070", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-31802\n\nSSD Advisory \u2013 NETGEAR Nighthawk R7000 httpd PreAuth RCE.\n\nhttps://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/", "creation_timestamp": "2021-04-27T06:39:32.000000Z"}, {"uuid": "5e8377a8-2d8c-475d-9fbc-903c84fdee2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3231", "content": "#WLAN_Security\nNETGEAR Nighthawk Smart Wi-Fi\u00a0Router R7000 - httpd PreAuth RCE (PoC for CVE-2021-31802)\nhttps://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce", "creation_timestamp": "2021-04-28T10:59:01.000000Z"}, {"uuid": "1341b780-c0d0-47a9-a901-04cd02a14696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "seen", "source": "https://t.me/cissp/3053", "content": "WLAN Security:\nNETGEAR Nighthawk Smart Wi-Fi\u00a0Router R7000 - httpd PreAuth RCE (PoC for CVE-2021-31802)\nhttps://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce\n\nexploit:\nCVE-2021-26868:\nWindows 10 LPE Exploit\nhttps://github.com/mavillon/CVE-2021-26868\n\n\nThreat Research:\nAn information disclosure vulnerability exists in the\n/proc/pid/syscall functionality of Linux Kernel 5.1\nStable and 5.4.66 (PoC for CVE-2020-28588)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1211", "creation_timestamp": "2026-09-01T17:00:52.635369Z"}, {"uuid": "61651b69-ab26-4664-8f77-451dcf96f117", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "seen", "source": "https://t.me/cissp/3053", "content": "WLAN Security:\nNETGEAR Nighthawk Smart Wi-Fi\u00a0Router R7000 - httpd PreAuth RCE (PoC for CVE-2021-31802)\nhttps://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce\n\nexploit:\nCVE-2021-26868:\nWindows 10 LPE Exploit\nhttps://github.com/mavillon/CVE-2021-26868\n\n\nThreat Research:\nAn information disclosure vulnerability exists in the\n/proc/pid/syscall functionality of Linux Kernel 5.1\nStable and 5.4.66 (PoC for CVE-2020-28588)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1211", "creation_timestamp": "2026-09-02T01:04:42.505908Z"}, {"uuid": "98cb8fe7-517f-4e2d-9b02-7f5cda43ef44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"armle\", \"author\": [\"colorlight2019\", \"SSD Disclosure\", \"Grant Willcox (tekwizz123)\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a heap buffer overflow in the genie.cgi?backup.cgi\\n          page of Netgear R7000 routers running firmware version 1.0.11.116.\\n          Successful exploitation results in unauthenticated attackers gaining\\n          code execution as the root user.\\n\\n          The exploit utilizes these privileges to enable the telnet server\\n          which allows attackers to connect to the target and execute commands\\n          as the admin user from within a BusyBox shell. Users can connect to\\n          this telnet server by running the command \\\"telnet *target IP*\\\".\", \"disclosure_date\": \"2021-04-21\", \"fullname\": \"auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"Netgear R7000 backup.cgi Heap Overflow RCE\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"config-changes\"], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/auxiliary/admin/http/netgear_r7000_backup_cgi_heap_overflow_rce.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"admin/http/netgear_r7000_backup_cgi_heap_overflow_rce\", \"references\": [\"URL-https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/\", \"CVE-2021-31802\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:48.538183Z"}, {"uuid": "d50763e4-5181-4d78-8804-014de433b07f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31802", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3053", "content": "WLAN Security:\nNETGEAR Nighthawk Smart Wi-Fi\u00a0Router R7000 - httpd PreAuth RCE (PoC for CVE-2021-31802)\nhttps://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce\n\nexploit:\nCVE-2021-26868:\nWindows 10 LPE Exploit\nhttps://github.com/mavillon/CVE-2021-26868\n\n\nThreat Research:\nAn information disclosure vulnerability exists in the\n/proc/pid/syscall functionality of Linux Kernel 5.1\nStable and 5.4.66 (PoC for CVE-2020-28588)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1211", "creation_timestamp": "2026-09-11T08:00:07.782208Z"}]}