PT-2021-22181 · NetGear · Rax20+12

Crixer · Published 2021-08-11 · Updated 2021-08-19 · CVE-2021-38524

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MK62 versions prior to 1.0.6.110 MR60 versions prior to 1.0.6.110 MS60 versions prior to 1.0.6.110 RAX15 versions prior to 1.0.2.82 RAX20 versions prior to 1.0.2.82 RAX200 versions prior to 1.0.3.106 RAX45 versions prior to 1.0.2.32 RAX50 versions prior to 1.0.2.32 RAX75 versions prior to 1.0.3.106 RAX80 versions prior to 1.0.3.106 RBK752 versions prior to 3.2.16.6 RBR750 versions prior to 3.2.16.6 RBS750 versions prior to 3.2.16.6

Description The issue is a stack-based buffer overflow that can be exploited by an authenticated user. This affects various NETGEAR devices.

Recommendations For MK62 versions prior to 1.0.6.110, update to version 1.0.6.110 or later. For MR60 versions prior to 1.0.6.110, update to version 1.0.6.110 or later. For MS60 versions prior to 1.0.6.110, update to version 1.0.6.110 or later. For RAX15 versions prior to 1.0.2.82, update to version 1.0.2.82 or later. For RAX20 versions prior to 1.0.2.82, update to version 1.0.2.82 or later. For RAX200 versions prior to 1.0.3.106, update to version 1.0.3.106 or later. For RAX45 versions prior to 1.0.2.32, update to version 1.0.2.32 or later. For RAX50 versions prior to 1.0.2.32, update to version 1.0.2.32 or later. For RAX75 versions prior to 1.0.3.106, update to version 1.0.3.106 or later. For RAX80 versions prior to 1.0.3.106, update to version 1.0.3.106 or later. For RBK752 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For RBR750 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For RBS750 versions prior to 3.2.16.6, update to version 3.2.16.6 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-38524

Affected Products

Mk62

Mr60

Ms60

Rax15

Rax20

Rax200

Rax45

Rax50

Rax75

Rax80

Rbk752

Rbr750

Rbs750

References · 6

• https://osv.dev/vulnerability/CVE-2021-38524 · Vendor Advisory
• https://kb.netgear.com/000063779/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2020-0225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38524 · Security Note
• https://t.me/cvenotify/19066 · Telegram Post
• https://t.me/cvenotify/19716 · Telegram Post
• https://t.me/cvenotify/19062 · Telegram Post