CVE-2021-45619 Information

Description

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects EX6200v2 before 1.0.1.86 EX6250 before 1.0.0.134 EX7700 before 1.0.0.216 EX8000 before 1.0.1.232 LBR1020 before 2.6.3.58 LBR20 before 2.6.3.50 R7800 before 1.0.2.80 R8900 before 1.0.5.26 R9000 before 1.0.5.26 RBS50Y before 2.7.3.22 WNR2000v5 before 1.0.0.76 XR700 before 1.0.1.36 EX6150v2 before 1.0.1.98 EX7300 before 1.0.2.158 EX7320 before 1.0.0.134 RAX10 before 1.0.2.88 RAX120 before 1.2.0.16 RAX70 before 1.0.2.88 EX6100v2 before 1.0.1.98 EX6400 before 1.0.2.158 EX7300v2 before 1.0.0.134 R6700AX before 1.0.2.88 RAX120v2 before 1.2.0.16 RAX78 before 1.0.2.88 EX6410 before 1.0.0.134 RBR10 before 2.7.3.22 RBR20 before 2.7.3.22 RBR350 before 4.3.4.7 RBR40 before 2.7.3.22 RBR50 before 2.7.3.22 EX6420 before 1.0.0.134 RBS10 before 2.7.3.22 RBS20 before 2.7.3.22 RBS350 before 4.3.4.7 RBS40 before 2.7.3.22 RBS50 before 2.7.3.22 EX6400v2 before 1.0.0.134 RBK12 before 2.7.3.22 RBK20 before 2.7.3.22 RBK352 before 4.3.4.7 RBK40 before 2.7.3.22 and RBK50 before 2.7.3.22.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://kb.netgear.com/000064492/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0435

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8