CVE-2013-2751

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-12-12 · updated 2026-06-16
Weakness: CWE-94

Description

Eval injection vulnerability in frontview/lib/np_handler.pl in the FrontView web interface in NETGEAR ReadyNAS RAIDiator before 4.1.12 and 4.2.x before 4.2.24 allows remote attackers to execute arbitrary Perl code via a crafted request, related to the "forgot password workflow."

Affected products

NETGEAR Raidiator: from 4.1 before 4.1.12; from 4.2 before 4.2.24 — fixed in 4.1.12, 4.2.24

How to fix

Upgrade to a fixed version: NETGEAR Raidiator 4.1.12, 4.2.24. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/123726/Netgear-ReadyNAS-Complete-System-Takeover.html
http://www.exploit-db.com/exploits/29815
http://www.osvdb.org/98826
http://www.readynas.com/?p=7002
http://www.tripwire.com/register/security-advisory-netgear-readynas/
http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/
http://packetstormsecurity.com/files/123726/Netgear-ReadyNAS-Complete-System-Takeover.html
http://www.exploit-db.com/exploits/29815
http://www.osvdb.org/98826
http://www.readynas.com/?p=7002
http://www.tripwire.com/register/security-advisory-netgear-readynas/
http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/

Get alerted when CVE-2013-2751 or the next vulnerability affects your stack