PT-2021-5725 · NetGear · Netgear Rbk352+1

Published 2021-09-26 · Updated 2023-08-08 · CVE-2021-45494

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR RBK352 versions prior to 4.4.0.10 NETGEAR RBR350 versions prior to 4.4.0.10 NETGEAR RBS350 versions prior to 4.4.0.10

Description The issue allows an attacker to read arbitrary files, potentially leading to unauthorized access to protected information. This is related to the disclosure of a resource to an erroneous area, which can be exploited by a remote attacker.

Recommendations For NETGEAR RBK352 versions prior to 4.4.0.10, update to version 4.4.0.10 or later. For NETGEAR RBR350 versions prior to 4.4.0.10, update to version 4.4.0.10 or later. For NETGEAR RBS350 versions prior to 4.4.0.10, update to version 4.4.0.10 or later.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2022-00168

CVE-2021-45494

Affected Products

Netgear Rbk352

Netgear Rbr350

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-45494 · Security Note
• https://bdu.fstec.ru/vul/2022-00168 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45494 · Vendor Advisory
• https://kb.netgear.com/000064160/Security-Advisory-for-Arbitrary-File-Read-on-Some-WiFi-Systems-PSV-2021-0044 · Vendor Advisory