PT-2021-22193 · NetGear · R7200+18

Nstarke · Published 2021-08-10 · Updated 2021-08-19 · CVE-2021-38536

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NETGEAR D6200 versions prior to 1.1.00.40 NETGEAR D7000 versions prior to 1.0.1.78 NETGEAR R6020 versions prior to 1.0.0.48 NETGEAR R6080 versions prior to 1.0.0.48 NETGEAR R6120 versions prior to 1.0.0.66 NETGEAR R6260 versions prior to 1.1.0.78 NETGEAR R6700v2 versions prior to 1.2.0.76 NETGEAR R6800 versions prior to 1.2.0.76 NETGEAR R6900v2 versions prior to 1.2.0.76 NETGEAR R6850 versions prior to 1.1.0.78 NETGEAR R7200 versions prior to 1.2.0.76 NETGEAR R7350 versions prior to 1.2.0.76 NETGEAR R7400 versions prior to 1.2.0.76 NETGEAR R7450 versions prior to 1.2.0.76 NETGEAR AC2100 versions prior to 1.2.0.76 NETGEAR AC2400 versions prior to 1.2.0.76 NETGEAR AC2600 versions prior to 1.2.0.76 NETGEAR RAX35 versions prior to 1.0.3.62 NETGEAR RAX40 versions prior to 1.0.3.62

Description The issue is related to stored XSS, affecting various NETGEAR devices.

Recommendations Update D6200 to version 1.1.00.40 or later Update D7000 to version 1.0.1.78 or later Update R6020 to version 1.0.0.48 or later Update R6080 to version 1.0.0.48 or later Update R6120 to version 1.0.0.66 or later Update R6260 to version 1.1.0.78 or later Update R6700v2 to version 1.2.0.76 or later Update R6800 to version 1.2.0.76 or later Update R6900v2 to version 1.2.0.76 or later Update R6850 to version 1.1.0.78 or later Update R7200 to version 1.2.0.76 or later Update R7350 to version 1.2.0.76 or later Update R7400 to version 1.2.0.76 or later Update R7450 to version 1.2.0.76 or later Update AC2100 to version 1.2.0.76 or later Update AC2400 to version 1.2.0.76 or later Update AC2600 to version 1.2.0.76 or later Update RAX35 to version 1.0.3.62 or later Update RAX40 to version 1.0.3.62 or later

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-38536

Affected Products

Ac2100

Ac2400

Ac2600

D6200

D7000

R6020

R6080

R6120

R6260

R6700V2

R6800

R6850

R6900V2

R7200

R7350

R7400

R7450

Rax35

Rax40

References · 4

• https://osv.dev/vulnerability/CVE-2021-38536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38536 · Security Note
• https://kb.netgear.com/000063774/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0193 · Vendor Advisory
• https://t.me/cibsecurity/27123 · Telegram Post