PT-2021-23299 · NetGear · Netgear Rax40+2

Efstratios Chatzoglou · Published 2021-12-09 · Updated 2021-12-13 · CVE-2021-41449

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netgear RAX35 versions prior to 1.0.4.102 Netgear RAX38 versions prior to 1.0.4.102 Netgear RAX40 versions prior to 1.0.4.102

Description A path traversal attack in the web interfaces of the affected routers allows a remote unauthenticated attacker to gain access to sensitive restricted information, such as forbidden files of the web application, via sending a specially crafted HTTP packet.

Recommendations For Netgear RAX35 version prior to 1.0.4.102, update to version 1.0.4.102 or later. For Netgear RAX38 version prior to 1.0.4.102, update to version 1.0.4.102 or later. For Netgear RAX40 version prior to 1.0.4.102, update to version 1.0.4.102 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-41449

Affected Products

Netgear Rax35

Netgear Rax38

Netgear Rax40

References · 8

• http://netgear.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41449 · Vendor Advisory
• https://netgear.com/about/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41449 · Security Note
• https://kb.netgear.com/000064405/Security-Advisory-for-Path-Traversal-on-Some-Routers-PSV-2021-0268 · Vendor Advisory
• https://t.me/cvenotify/24463 · Telegram Post
• https://t.me/cibsecurity/33679 · Telegram Post
• http://rax40.com · Note