6.5

CVE-2021-45665

Certain NETGEAR devices are affected by stored XSS. This affects EAX20 before 1.0.0.36, EAX80 before 1.0.1.62, EX3700 before 1.0.0.90, EX3800 before 1.0.0.90, EX6120 before 1.0.0.64, EX6130 before 1.0.0.44, EX7500 before 1.0.0.72, RBW30 before 2.6.1.4, RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, RBS850 before 3.2.16.6, and RBS40V before 2.6.1.4.

Data is provided by the National Vulnerability Database (NVD)
Netgear ≫ Eax20 Firmware Version < 1.0.0.36
   Netgear ≫ Eax20 Version-
Netgear ≫ Eax80 Firmware Version < 1.0.1.62
   Netgear ≫ Eax80 Version-
Netgear ≫ Ex3700 Firmware Version < 1.0.0.90
   Netgear ≫ Ex3700 Version-
Netgear ≫ Ex3800 Firmware Version < 1.0.0.90
   Netgear ≫ Ex3800 Version-
Netgear ≫ Ex6120 Firmware Version < 1.0.0.64
   Netgear ≫ Ex6120 Version-
Netgear ≫ Ex6130 Firmware Version < 1.0.0.44
   Netgear ≫ Ex6130 Version-
Netgear ≫ Ex7500 Firmware Version < 1.0.0.72
   Netgear ≫ Ex7500 Version-
Netgear ≫ Rbw30 Firmware Version < 2.6.1.4
   Netgear ≫ Rbw30 Version-
Netgear ≫ Rbk752 Firmware Version < 3.2.16.6
   Netgear ≫ Rbk752 Version-
Netgear ≫ Rbr750 Firmware Version < 3.2.16.6
   Netgear ≫ Rbr750 Version-
Netgear ≫ Rbs750 Firmware Version < 3.2.16.6
   Netgear ≫ Rbs750 Version-
Netgear ≫ Rbk852 Firmware Version < 3.2.16.6
   Netgear ≫ Rbk852 Version-
Netgear ≫ Rbr850 Firmware Version < 3.2.16.6
   Netgear ≫ Rbr850 Version-
Netgear ≫ Rbs850 Firmware Version < 3.2.16.6
   Netgear ≫ Rbs850 Version-
Netgear ≫ Rbs40v Firmware Version < 2.6.1.4
   Netgear ≫ Rbs40v Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.27% 0.479
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
cve@mitre.org 6.5 0.7 5.3
CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.