CVE-2013-2751

CriticalCVSS 10.0/10Last modified Jun 16, 2026

Description

Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/123726/Netgear-ReadyNAS-Complete-System-Takeover.htmlThird Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/29815Exploit, Third Party Advisory, VDB Entry
http://www.osvdb.org/98826Broken Link
http://www.readynas.com/?p=7002Patch, Vendor Advisory
http://www.tripwire.com/register/security-advisory-netgear-readynas/Third Party Advisory
http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/Third Party Advisory
http://packetstormsecurity.com/files/123726/Netgear-ReadyNAS-Complete-System-Takeover.htmlThird Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/29815Exploit, Third Party Advisory, VDB Entry
http://www.osvdb.org/98826Broken Link
http://www.readynas.com/?p=7002Patch, Vendor Advisory
http://www.tripwire.com/register/security-advisory-netgear-readynas/Third Party Advisory
http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/Third Party Advisory

Timeline

Published: Dec 12, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-27526.8Cross-site request forgery (CSRF) vulnerability in frontview/lib/np_handler.pl in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before CVE-2013-27546.8Cross-site request forgery (CSRF) vulnerability in Umisoft UMI.CMS before 2.9 build 21905 allows remote attackers to hijack the authenticati CVE-2013-27565.0Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attacker CVE-2013-27577.5Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C does not properly restrict access to VNC ports on the managemen CVE-2013-27585.0Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predi CVE-2013-27606.8Buffer overflow in Groovy Media Player 3.2.0 allows remote attackers to execute arbitrary code via a long string in a .m3u file.CVE-2013-27614.0The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module cras CVE-2013-276210.0The Schneider Electric Magelis XBT HMI controller has a default password for authentication of configuration uploads, which makes it easier CVE-2013-27635.0The Schneider Electric M340 PLC modules allow remote attackers to cause a denial of service (resource consumption) via unspecified vectors. CVE-2013-27646.1Secure Entry Server before 4.7.0 contains a URI Redirection vulnerability which could allow remote attackers to conduct phishing attacks due CVE-2013-27655.0The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereferenc CVE-2013-27664.3Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.3.0 through 4.3.5 allows remote attackers to inject arbitrary web script