PT-2021-17355 · NetGear · Netgear Nighthawk R7800

Pedrib1337 + 3 · Published 2021-02-24 · Updated 2021-04-27 · CVE-2021-27251

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk R7800 (affected versions not specified)

Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within handling of firmware updates, resulting from a fallback to an insecure protocol to deliver updates. An attacker can leverage this issue to execute code in the context of root.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2021-27251

ZDI-21-247

Affected Products

Netgear Nighthawk R7800

References · 5

• https://zerodayinitiative.com/advisories/ZDI-21-247 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27251 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27251 · Vendor Advisory
• https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders · Vendor Advisory
• https://t.me/cvenotify/13823 · Telegram Post