6.5
CVE-2021-34983
- EPSS 0.18%
- Published 07.05.2024 23:15:13
- Last modified 14.08.2025 01:40:56
- Source zdi-disclosures@trendmicro.com
- Teams watchlist Login
- Open Login
NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of authentication prior to allowing access to system configuration information. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13708.
Data is provided by the National Vulnerability Database (NVD)
Netgear ≫ Xr1000 Firmware Version < 1.0.0.64
Netgear ≫ Xr300 Firmware Version < 1.0.3.68
Netgear ≫ D6220 Firmware Version < 1.0.0.76
Netgear ≫ D6400 Firmware Version < 1.0.0.108
Netgear ≫ D7000v2 Firmware Version < 1.0.0.76
Netgear ≫ Dgn2200v4 Firmware Version < 1.0.0.126
Netgear ≫ V6510-1fxaus Firmware Version < 1.0.0.80
Netgear ≫ Dc112a Firmware Version < 1.0.0.62
Netgear ≫ Ex3700 Firmware Version < 1.0.0.94
Netgear ≫ Ex3800 Firmware Version < 1.0.0.94
Netgear ≫ Ex6120 Firmware Version < 1.0.0.66
Netgear ≫ Ex6130 Firmware Version < 1.0.0.46
Netgear ≫ Ex7000 Firmware Version < 1.0.1.106
Netgear ≫ Ex7500 Firmware Version < 1.0.1.76
Netgear ≫ Mr60 Firmware Version < 1.1.6.122
Netgear ≫ Mr80 Firmware Version < 1.1.6.10
Netgear ≫ Ms60 Firmware Version < 1.1.6.122
Netgear ≫ Ms80 Firmware Version < 1.1.6.10
Netgear ≫ Lax20 Firmware Version < 1.1.6.30
Netgear ≫ R6400 Firmware Version < 1.0.1.76
Netgear ≫ R6400v2 Firmware Version < 1.0.4.120
Netgear ≫ R6700v3 Firmware Version < 1.0.4.120
Netgear ≫ R6900p Firmware Version < 1.3.3.148
Netgear ≫ R7000 Firmware Version < 1.0.11.128
Netgear ≫ R7000p Firmware Version < 1.3.3.148
Netgear ≫ R7100lg Firmware Version < 1.0.0.72
Netgear ≫ R7850 Firmware Version < 1.0.5.76
Netgear ≫ R7900p Firmware Version < 1.4.2.84
Netgear ≫ R7960p Firmware Version < 1.4.2.84
Netgear ≫ R8000 Firmware Version < 1.0.4.76
Netgear ≫ R8000p Firmware Version < 1.4.2.84
Netgear ≫ R8300 Firmware Version < 1.0.2.156
Netgear ≫ R8500 Firmware Version < 1.0.2.156
Netgear ≫ Rax15 Firmware Version < 1.0.4.100
Netgear ≫ Rax20 Firmware Version < 1.0.4.100
Netgear ≫ Rax200 Firmware Version < 1.0.5.132
Netgear ≫ Rax35v2 Firmware Version < 1.0.4.100
Netgear ≫ Rax38v2 Firmware Version < 1.0.4.100
Netgear ≫ Rax40v2 Firmware Version < 1.0.4.100
Netgear ≫ Rax42 Firmware Version < 1.0.4.100
Netgear ≫ Rax43 Firmware Version < 1.0.4.100
Netgear ≫ Rax45 Firmware Version < 1.0.4.100
Netgear ≫ Rax48 Firmware Version < 1.0.4.100
Netgear ≫ Rax50 Firmware Version < 1.0.4.100
Netgear ≫ Rax50s Firmware Version < 1.0.4.100
Netgear ≫ Rax75 Firmware Version < 1.0.5.132
Netgear ≫ Rax80 Firmware Version < 1.0.5.132
Netgear ≫ Raxe450 Firmware Version < 1.0.8.70
Netgear ≫ Raxe500 Firmware Version < 1.0.8.70
Netgear ≫ Rs400 Firmware Version < 1.5.1.80
Netgear ≫ Wndr3400v3 Firmware Version < 1.0.1.42
Netgear ≫ Wnr3500lv2 Firmware Version < 1.2.0.70
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.18% | 0.405 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| zdi-disclosures@trendmicro.com | 6.5 | 2.8 | 3.6 |
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.