xr300 firmware vulnerabilities and fixes

Recent CVEs affecting xr300 firmware, with upgrade or downgrade steps. 26 tracked.

Also searched as: xr300firmware.

xr300 firmware has 26 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2025-07-15. Highest priority: CVE-2024-52018 (score 47/100).

• CVE-2025-52082 MEDIUM 6.5 MITIGATE In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow exists in the HTTPD service through the usb_
• CVE-2025-52081 MEDIUM 6.5 MITIGATE In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service th
• CVE-2025-52080 MEDIUM 6.5 MITIGATE In Netgear XR300 V1.0.3.38_10.3.30, a stack-based buffer overflow vulnerability exists in the HTTPD service th
• CVE-2024-52026 MEDIUM 5.7 MITIGATE MITIGATE Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow
• CVE-2024-52025 MEDIUM 5.7 MITIGATE MITIGATE Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow
• CVE-2024-52024 MEDIUM 5.7 MITIGATE MITIGATE Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow
• CVE-2024-52023 MEDIUM 5.7 MITIGATE MITIGATE Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow
• CVE-2024-52022 HIGH 8.0 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai
• CVE-2024-52018 HIGH 8.0 MITIGATE Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name paramet
• CVE-2024-52017 MEDIUM 5.7 MITIGATE Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wire
• CVE-2024-52016 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multip
• CVE-2024-52015 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai
• CVE-2024-52014 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai
• CVE-2024-52013 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai
• CVE-2024-51022 MEDIUM 5.7 MITIGATE Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid parameter in bridge_wireless_m
• CVE-2024-51021 HIGH 8.0 MITIGATE MITIGATE Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injecti
• CVE-2024-51016 MEDIUM 5.7 MITIGATE Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the addName%d parameter in usb_approve.
• CVE-2024-51014 MEDIUM 5.7 MITIGATE Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid_an parameter in bridge_wireles
• CVE-2024-51011 MEDIUM 5.7 MITIGATE MITIGATE Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow
• CVE-2024-51010 HIGH 8.0 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai
• CVE-2024-51008 HIGH 8.0 MITIGATE Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name paramet
• CVE-2024-51007 MEDIUM 5.7 MITIGATE Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cg
• CVE-2024-51003 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multip
• CVE-2024-51002 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai
• CVE-2024-50997 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai
• CVE-2024-50996 MEDIUM 5.7 MITIGATE MITIGATE Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contai

FAQ

How do I fix xr300 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is xr300 firmware being exploited right now?

None of the tracked xr300 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which xr300 firmware CVE should I patch first?

CVE-2024-52018 currently ranks highest (47/100): Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name paramet.

RSS feed for xr300 firmware · ← Back to latest CVEs