Critical severity9.1NVD Advisory· Published Feb 24, 2020· Updated Jun 17, 2026
CVE-2019-12510
CVE-2019-12510
Description
In NETGEAR Nighthawk X10-R900 prior to 1.0.4.26, an attacker may bypass all authentication checks on the device's "NETGEAR Genie" SOAP API ("/soap/server_sa") by supplying a malicious X-Forwarded-For header of the device's LAN IP address (192.168.1.1) in every request. As a result, an attacker may modify almost all of the device's settings and view various configuration settings.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:o:netgear:nighthawk_x10-r9000_firmware:*:*:*:*:*:*:*:*Range: <1.0.4.26
- NETGEAR/Nighthawk X10-R900description
- Range: <1.0.4.26
Patches
Vulnerability mechanics
References
1- www.ise.io/casestudies/sohopelessly-broken-2-0/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.