PT-2021-5726 · NetGear · Netgear Rax40+2

Published 2021-12-20 · Updated 2022-01-04 · CVE-2021-45493

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AC:L/AV:N/A:L/C:H/I:L/PR:N/S:U/UI:R

Name of the Vulnerable Software and Affected Versions NETGEAR RAX35 versions prior to 1.0.4.102 NETGEAR RAX38 versions prior to 1.0.4.102 NETGEAR RAX40 versions prior to 1.0.4.102

Description The issue is related to the disclosure of administrative credentials in certain NETGEAR devices. It may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For RAX35 versions prior to 1.0.4.102, update to version 1.0.4.102 or later. For RAX38 versions prior to 1.0.4.102, update to version 1.0.4.102 or later. For RAX40 versions prior to 1.0.4.102, update to version 1.0.4.102 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-00169

CVE-2021-45493

Affected Products

Netgear Rax35

Netgear Rax38

Netgear Rax40

References · 4

• https://osv.dev/vulnerability/CVE-2021-45493 · Vendor Advisory
• https://kb.netgear.com/000064453/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-Routers-PSV-2019-0293 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-45493 · Security Note