CVE-2021-45618 Information

Description

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.64 EX6200v2 before 1.0.1.86 EX6250 before 1.0.0.134 EX7700 before 1.0.0.216 EX8000 before 1.0.1.232 LBR20 before 2.6.3.50 R7800 before 1.0.2.80 R8900 before 1.0.5.26 R9000 before 1.0.5.26 RAX120 before 1.2.0.16 RBS50Y before 1.0.0.56 WNR2000v5 before 1.0.0.76 XR450 before 2.3.2.114 XR500 before 2.3.2.114 XR700 before 1.0.1.36 EX6150v2 before 1.0.1.98 EX7300 before 1.0.2.158 EX7320 before 1.0.0.134 EX6100v2 before 1.0.1.98 EX6400 before 1.0.2.158 EX7300v2 before 1.0.0.134 EX6410 before 1.0.0.134 RBR10 before 2.6.1.44 RBR20 before 2.6.2.104 RBR40 before 2.6.2.104 RBR50 before 2.7.2.102 EX6420 before 1.0.0.134 RBS10 before 2.6.1.44 RBS20 before 2.6.2.104 RBS40 before 2.6.2.104 RBS50 before 2.7.2.102 EX6400v2 before 1.0.0.134 RBK12 before 2.6.1.44 RBK20 before 2.6.2.104 RBK40 before 2.6.2.104 and RBK50 before 2.7.2.102.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://kb.netgear.com/000064490/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0422

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8