7.8

CVE-2021-45602

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 before 1.0.0.90, WN3000RPv3 before 1.0.2.100, LBR1020 before 2.6.5.20, LBR20 before 2.6.5.32, R6700AX before 1.0.10.110, R7800 before 1.0.2.86, R8900 before 1.0.5.38, R9000 before 1.0.5.38, RAX10 before 1.0.10.110, RAX120v1 before 1.2.3.28, RAX120v2 before 1.2.3.28, RAX70 before 1.0.10.110, RAX78 before 1.0.10.110, XR450 before 2.3.2.130, XR500 before 2.3.2.130, and XR700 before 1.0.1.46.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netgear ≫ D7800 Firmware Version < 1.0.1.66
   Netgear ≫ D7800 Version -
Netgear ≫ Ex2700 Firmware Version < 1.0.1.68
   Netgear ≫ Ex2700 Version -
Netgear ≫ Wn3000rpv2 Firmware Version < 1.0.0.90
   Netgear ≫ Wn3000rpv2 Version -
Netgear ≫ Wn3000rpv3 Firmware Version < 1.0.2.100
   Netgear ≫ Wn3000rpv3 Version -
Netgear ≫ Lbr1020 Firmware Version < 2.6.5.20
   Netgear ≫ Lbr1020 Version -
Netgear ≫ Lbr20 Firmware Version < 2.6.5.32
   Netgear ≫ Lbr20 Version -
Netgear ≫ R6700ax Firmware Version < 1.0.10.110
   Netgear ≫ R6700ax Version -
Netgear ≫ R7800 Firmware Version < 1.0.2.86
   Netgear ≫ R7800 Version -
Netgear ≫ R8900 Firmware Version < 1.0.5.38
   Netgear ≫ R8900 Version -
Netgear ≫ R9000 Firmware Version < 1.0.5.38
   Netgear ≫ R9000 Version -
Netgear ≫ Rax10 Firmware Version < 1.0.10.110
   Netgear ≫ Rax10 Version -
Netgear ≫ Rax120v1 Firmware Version < 1.2.3.28
   Netgear ≫ Rax120v1 Version -
Netgear ≫ Rax120v2 Firmware Version < 1.2.3.28
   Netgear ≫ Rax120v2 Version -
Netgear ≫ Rax70 Firmware Version < 1.0.10.110
   Netgear ≫ Rax70 Version -
Netgear ≫ Rax78 Firmware Version < 1.0.10.110
   Netgear ≫ Rax78 Version -
Netgear ≫ Xr450 Firmware Version < 2.3.2.130
   Netgear ≫ Xr450 Version -
Netgear ≫ Xr500 Firmware Version < 2.3.2.130
   Netgear ≫ Xr500 Version -
Netgear ≫ Xr700 Firmware Version < 1.0.1.46
   Netgear ≫ Xr700 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.7% 0.483
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
MITRE 6.1 1.8 4.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/
Third Party Advisory
https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171
Patch
Vendor Advisory