PT-2021-5850 · NetGear · Netgear Xr1000

Published 2021-09-26 · Updated 2022-01-04 · CVE-2021-45513

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR XR1000 versions prior to 1.0.0.58

Description The issue is related to insufficient input sanitization in the Wi-Fi router's firmware, allowing a remote attacker to execute arbitrary commands. This can be exploited by an unauthenticated attacker, potentially leading to command injection.

Recommendations For versions prior to 1.0.0.58, update to version 1.0.0.58 or later to resolve the issue. As a temporary workaround, consider restricting access to the router's interface to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-00365

CVE-2021-45513

Affected Products

Netgear Xr1000

References · 4

• https://bdu.fstec.ru/vul/2022-00365 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-45513 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45513 · Vendor Advisory
• https://kb.netgear.com/000064149/Security-Advisory-for-Command-Injection-on-XR1000-PSV-2021-0010 · Vendor Advisory