CVE-2021-20170

EPSS 0.16%
Published 30.12.2021 22:15:09
Last modified 21.11.2024 05:46:03
Source vulnreport@tenable.com
Teams watchlist Login
Open Login

Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Netgear ≫ Rax43 Firmware Version1.0.3.96

Netgear ≫ Rax43 Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.16%	0.375

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://www.tenable.com/security/research/tra-2021-55

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2021-20170

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-20170

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-20170

EUVD