4.8

CVE-2021-38534

Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6100 before 1.0.0.60, D6200 before 1.1.00.36, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.70, D7000v2 before 1.0.0.53, D8500 before 1.0.3.44, DC112A before 1.0.0.42, DGN2200v4 before 1.0.0.110, DGND2200Bv4 before 1.0.0.109, DM200 before 1.0.0.61, JR6150 before 1.0.1.18, PR2000 before 1.0.0.28, R6020 before 1.0.0.42, R6050 before 1.0.1.18, R6080 before 1.0.0.42, R6220 before 1.1.0.80, R6230 before 1.1.0.80, R6250 before 1.0.4.34, R6260 before 1.1.0.64, R6300v2 before 1.0.4.34, R6400 before 1.0.1.46, R6400v2 before 1.0.2.62, R6700 before 1.0.2.6, R6700v2 before 1.2.0.36, R6700v3 before 1.0.2.62, R6800 before 1.2.0.36, R6900 before 1.0.2.4, R6900P before 1.3.1.64, R6900v2 before 1.2.0.36, R7000 before 1.0.9.60, R7000P before 1.3.1.64, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7450 before 1.2.0.36, R7900 before 1.0.3.8, R7900P before 1.4.1.50, R8000 before 1.0.4.28, R8000P before 1.4.1.50, R8300 before 1.0.2.130, R8500 before 1.0.2.130, WNDR3400v3 before 1.0.1.24, WNR2020 before 1.1.0.62, WNR3500Lv2 before 1.2.0.62, XR450 before 2.3.2.40, and XR500 before 2.3.2.40.

Data is provided by the National Vulnerability Database (NVD)
NetgearD3600 Firmware Version < 1.0.0.76
   NetgearD3600 Version-
NetgearD6000 Firmware Version < 1.0.0.76
   NetgearD6000 Version-
NetgearD6100 Firmware Version < 1.0.0.60
   NetgearD6100 Version-
NetgearD6200 Firmware Version < 1.1.00.36
   NetgearD6200 Version-
NetgearD6220 Firmware Version < 1.0.0.52
   NetgearD6220 Version-
NetgearD6400 Firmware Version < 1.0.0.86
   NetgearD6400 Version-
NetgearD7000 Firmware Version < 1.0.1.70
   NetgearD7000 Version-
NetgearD7000 Firmware Version < 1.0.0.53
   NetgearD7000 Versionv2
NetgearD8500 Firmware Version < 1.0.3.44
   NetgearD8500 Version-
NetgearDc112a Firmware Version < 1.0.0.42
   NetgearDc112a Version-
NetgearDgn2200 Firmware Version < 1.0.0.110
   NetgearDgn2200 Versionv4
NetgearDgnd2200b Firmware Version < 1.0.0.109
   NetgearDgnd2200b Versionv4
NetgearDm200 Firmware Version < 1.0.0.61
   NetgearDm200 Version-
NetgearJr6150 Firmware Version < 1.0.1.18
   NetgearJr6150 Version-
NetgearPr2000 Firmware Version < 1.0.0.28
   NetgearPr2000 Version-
NetgearR6020 Firmware Version < 1.0.0.42
   NetgearR6020 Version-
NetgearR6050 Firmware Version < 1.0.1.18
   NetgearR6050 Version-
NetgearR6080 Firmware Version < 1.0.0.42
   NetgearR6080 Version-
NetgearR6220 Firmware Version < 1.1.0.80
   NetgearR6220 Version-
NetgearR6230 Firmware Version < 1.1.0.80
   NetgearR6230 Version-
NetgearR6250 Firmware Version < 1.0.4.34
   NetgearR6250 Version-
NetgearR6260 Firmware Version < 1.1.0.64
   NetgearR6260 Version-
NetgearR6300 Firmware Version < 1.0.4.34
   NetgearR6300 Versionv2
NetgearR6400 Firmware Version < 1.0.1.46
   NetgearR6400 Version-
NetgearR6400 Firmware Version < 1.0.2.62
   NetgearR6400 Versionv2
NetgearR6700 Firmware Version < 1.0.2.6
   NetgearR6700 Version-
NetgearR6700 Firmware Version < 1.2.0.36
   NetgearR6700 Versionv2
NetgearR6700 Firmware Version < 1.0.2.62
   NetgearR6700 Versionv3
NetgearR6800 Firmware Version < 1.2.0.36
   NetgearR6800 Version-
NetgearR6900 Firmware Version < 1.0.2.4
   NetgearR6900 Version-
NetgearR6900p Firmware Version < 1.3.1.64
   NetgearR6900p Version-
NetgearR6900 Firmware Version < 1.2.0.36
   NetgearR6900 Versionv2
NetgearR7000 Firmware Version < 1.0.9.60
   NetgearR7000 Version-
NetgearR7000p Firmware Version < 1.3.1.64
   NetgearR7000p Version-
NetgearR7100lg Firmware Version < 1.0.0.50
   NetgearR7100lg Version-
NetgearR7300dst Firmware Version < 1.0.0.70
   NetgearR7300dst Version-
NetgearR7450 Firmware Version < 1.2.0.36
   NetgearR7450 Version-
NetgearR7900 Firmware Version < 1.0.3.8
   NetgearR7900 Version-
NetgearR7900p Firmware Version < 1.4.1.50
   NetgearR7900p Version-
NetgearR8000 Firmware Version < 1.0.4.28
   NetgearR8000 Version-
NetgearR8000p Firmware Version < 1.4.1.50
   NetgearR8000p Version-
NetgearR8300 Firmware Version < 1.0.2.130
   NetgearR8300 Version-
NetgearR8500 Firmware Version < 1.0.2.130
   NetgearR8500 Version-
NetgearWndr3400 Firmware Version < 1.0.1.24
   NetgearWndr3400 Versionv3
NetgearWnr2020 Firmware Version < 1.1.0.62
   NetgearWnr2020 Version-
NetgearWnr3500l Firmware Version < 1.2.0.62
   NetgearWnr3500l Versionv2
NetgearXr450 Firmware Version < 2.3.2.40
   NetgearXr450 Version-
NetgearXr500 Firmware Version < 2.3.2.40
   NetgearXr500 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.25% 0.478
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
cve@mitre.org 4.1 0.7 3.4
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.