CVE-2021-45602

Published: Dec 26, 2021Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 before 1.0.0.90, WN3000RPv3 before 1.0.2.100, LBR1020 before 2.6.5.20, LBR20 before 2.6.5.32, R6700AX before 1.0.10.110, R7800 before 1.0.2.86, R8900 before 1.0.5.38, R9000 before 1.0.5.38, RAX10 before 1.0.10.110, RAX120v1 before 1.2.3.28, RAX120v2 before 1.2.3.28, RAX70 before 1.0.10.110, RAX78 before 1.0.10.110, XR450 before 2.3.2.130, XR500 before 2.3.2.130, and XR700 before 1.0.1.46.

Affected (18)

Products: Netgear: D7800 Firmware, Ex2700 Firmware, Wn3000rpv2 Firmware, Wn3000rpv3 Firmware, Lbr1020 Firmware, Lbr20 Firmware, R6700ax Firmware, R7800 Firmware, R8900 Firmware, R9000 Firmware, Rax10 Firmware, Rax120v1 Firmware, Rax120v2 Firmware, Rax70 Firmware, Rax78 Firmware, Xr450 Firmware, Xr500 Firmware, Xr700 Firmware

18 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear D7800 Firmware	Before 1.0.1.66

Running on/with	Platform Versions
Netgear D7800	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Ex2700 Firmware	Before 1.0.1.68

Running on/with	Platform Versions
Netgear Ex2700	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Wn3000rpv2 Firmware	Before 1.0.0.90

Running on/with	Platform Versions
Netgear Wn3000rpv2	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Wn3000rpv3 Firmware	Before 1.0.2.100

Running on/with	Platform Versions
Netgear Wn3000rpv3	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Lbr1020 Firmware	Before 2.6.5.20

Running on/with	Platform Versions
Netgear Lbr1020	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Lbr20 Firmware	Before 2.6.5.32

Running on/with	Platform Versions
Netgear Lbr20	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear R6700ax Firmware	Before 1.0.10.110

Running on/with	Platform Versions
Netgear R6700ax	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear R7800 Firmware	Before 1.0.2.86

Running on/with	Platform Versions
Netgear R7800	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear R8900 Firmware	Before 1.0.5.38

Running on/with	Platform Versions
Netgear R8900	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear R9000 Firmware	Before 1.0.5.38

Running on/with	Platform Versions
Netgear R9000	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Rax10 Firmware	Before 1.0.10.110

Running on/with	Platform Versions
Netgear Rax10	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Rax120v1 Firmware	Before 1.2.3.28

Running on/with	Platform Versions
Netgear Rax120v1	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Rax120v2 Firmware	Before 1.2.3.28

Running on/with	Platform Versions
Netgear Rax120v2	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Rax70 Firmware	Before 1.0.10.110

Running on/with	Platform Versions
Netgear Rax70	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Rax78 Firmware	Before 1.0.10.110

Running on/with	Platform Versions
Netgear Rax78	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Xr450 Firmware	Before 2.3.2.130

Running on/with	Platform Versions
Netgear Xr450	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Xr500 Firmware	Before 2.3.2.130

Running on/with	Platform Versions
Netgear Xr500	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netgear Xr700 Firmware	Before 1.0.1.46

Running on/with	Platform Versions
Netgear Xr700	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/

Source: cve@mitre.org

Third Party Advisory

https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171

Source: cve@mitre.org

PatchVendor Advisory

https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.