PT-2021-19671 · NetGear · Netgear Ex3800+3

Joel St. John · Published 2021-08-10 · Updated 2021-08-19 · CVE-2021-32122

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions: NETGEAR EX3700 versions prior to 1.0.0.90 NETGEAR EX3800 versions prior to 1.0.0.90 NETGEAR EX6120 versions prior to 1.0.0.64 NETGEAR EX6130 versions prior to 1.0.0.44

Description: The issue is related to Cross-Site Request Forgery (CSRF), which is a type of attack that tricks a user into performing unintended actions on a web application. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations: For NETGEAR EX3700 versions prior to 1.0.0.90, update to version 1.0.0.90 or later. For NETGEAR EX3800 versions prior to 1.0.0.90, update to version 1.0.0.90 or later. For NETGEAR EX6120 versions prior to 1.0.0.64, update to version 1.0.0.64 or later. For NETGEAR EX6130 versions prior to 1.0.0.44, update to version 1.0.0.44 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-32122

Affected Products

Netgear Ex3700

Netgear Ex3800

Netgear Ex6120

Netgear Ex6130

References · 6

• https://kb.netgear.com/000063883/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Extenders-PSV-2021-0102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32122 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32122 · Vendor Advisory
• https://t.me/cibsecurity/27117 · Telegram Post
• https://t.me/cvenotify/19076 · Telegram Post
• https://t.me/cvenotify/19056 · Telegram Post