PT-2021-22177 · NetGear · Netgear R7000P+5

Published 2021-08-11 · Updated 2021-08-18 · CVE-2021-38520

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR R6400 versions prior to 1.0.1.52 NETGEAR R6400v2 versions prior to 1.0.4.84 NETGEAR R6700v3 versions prior to 1.0.4.84 NETGEAR R6700v2 versions prior to 1.2.0.62 NETGEAR R6900v2 versions prior to 1.2.0.62 NETGEAR R7000P versions prior to 1.3.2.124

Description The issue affects certain NETGEAR devices, allowing command injection by an authenticated user.

Recommendations For NETGEAR R6400 version prior to 1.0.1.52, update to version 1.0.1.52 or later. For NETGEAR R6400v2 version prior to 1.0.4.84, update to version 1.0.4.84 or later. For NETGEAR R6700v3 version prior to 1.0.4.84, update to version 1.0.4.84 or later. For NETGEAR R6700v2 version prior to 1.2.0.62, update to version 1.2.0.62 or later. For NETGEAR R6900v2 version prior to 1.2.0.62, update to version 1.2.0.62 or later. For NETGEAR R7000P version prior to 1.3.2.124, update to version 1.3.2.124 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-38520

Affected Products

Netgear R6400

Netgear R6400V2

Netgear R6700V2

Netgear R6700V3

Netgear R6900V2

Netgear R7000P

References · 7

• https://kb.netgear.com/000063763/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0565 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38520 · Security Note
• https://t.me/cibsecurity/27128 · Telegram Post
• https://t.me/cvenotify/19049 · Telegram Post
• https://t.me/cvenotify/19069 · Telegram Post
• https://t.me/cvenotify/19672 · Telegram Post