CVE-2019-14526

An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.

• CWE-352

• https://www.pentestpartners.com/security-blog/how-not-to-do-cross-site-request-forgery-protection-the-netgear-nighthawk-m1/Exploit, Third Party Advisory
• https://www.pentestpartners.com/security-blog/how-not-to-do-cross-site-request-forgery-protection-the-netgear-nighthawk-m1/Exploit, Third Party Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14518Evolution CMS 2.0.x allows XSS via a description and new cat…
• CVE-2019-1452Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14521The api/admin/logoupload Logo File upload feature in EMCA En…
• CVE-2019-14523An issue was discovered in Schism Tracker through 20190722. …7.8
• CVE-2019-14524An issue was discovered in Schism Tracker through 20190722. …7.8
• CVE-2019-14525In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6,…
• CVE-2019-14527An issue was discovered on NETGEAR Nighthawk M1 (MR1100) dev…
• CVE-2019-14528GnuCOBOL 2.2 has a heap-based buffer overflow in read_litera…
• CVE-2019-14529OpenEMR before 5.0.2 allows SQL Injection in interface/forms…9.8
• CVE-2019-1453A denial of service vulnerability exists in Remote Desktop P…7.5
• CVE-2019-14530An issue was discovered in custom/ajax_download.php in OpenE…8.8
• CVE-2019-14531An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There…