PT-2021-5855 · NetGear · Netgear Ex6130+13

Published 2021-09-26 · Updated 2022-01-06 · CVE-2021-45666

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AC:H/AV:A/A:L/C:L/I:H/PR:H/S:C/UI:R

Name of the Vulnerable Software and Affected Versions NETGEAR CBR40 versions prior to 2.5.0.10 NETGEAR EAX80 versions prior to 1.0.1.64 NETGEAR EX3700 versions prior to 1.0.0.90 NETGEAR EX3800 versions prior to 1.0.0.90 NETGEAR EX6120 versions prior to 1.0.0.64 NETGEAR EX6130 versions prior to 1.0.0.44 NETGEAR EX7500 versions prior to 1.0.0.72 NETGEAR RBW30 versions prior to 2.6.1.4 NETGEAR RBK752 versions prior to 3.2.16.6 NETGEAR RBR750 versions prior to 3.2.16.6 NETGEAR RBS750 versions prior to 3.2.16.6 NETGEAR RBK852 versions prior to 3.2.16.6 NETGEAR RBR850 versions prior to 3.2.16.6 NETGEAR RBS850 versions prior to 3.2.16.6 NETGEAR RBS40V versions prior to 2.6.1.4

Description The issue is related to stored XSS, which affects certain NETGEAR devices. This vulnerability may allow a remote attacker to perform cross-site scripting attacks due to the lack of protection measures for the web page structure.

Recommendations For NETGEAR CBR40 versions prior to 2.5.0.10, update to version 2.5.0.10 or later. For NETGEAR EAX80 versions prior to 1.0.1.64, update to version 1.0.1.64 or later. For NETGEAR EX3700 versions prior to 1.0.0.90, update to version 1.0.0.90 or later. For NETGEAR EX3800 versions prior to 1.0.0.90, update to version 1.0.0.90 or later. For NETGEAR EX6120 versions prior to 1.0.0.64, update to version 1.0.0.64 or later. For NETGEAR EX6130 versions prior to 1.0.0.44, update to version 1.0.0.44 or later. For NETGEAR EX7500 versions prior to 1.0.0.72, update to version 1.0.0.72 or later. For NETGEAR RBW30 versions prior to 2.6.1.4, update to version 2.6.1.4 or later. For NETGEAR RBK752 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBR750 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBS750 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBK852 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBR850 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBS850 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBS40V versions prior to 2.6.1.4, update to version 2.6.1.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-00370

CVE-2021-45666

Affected Products

Netgear Cbr40

Netgear Rax80

Netgear Ex3700

Netgear Ex3800

Netgear Ex6120

Netgear Ex6130

Netgear Ex7500

Netgear Rbk752

Netgear Rbk852

Netgear Rbr750

Netgear Rbr850

Netgear Rbs40

Netgear Rbs750

Netgear Rbw30

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-45666 · Security Note
• https://bdu.fstec.ru/vul/2022-00370 · Security Note
• https://kb.netgear.com/000064121/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-WiFi-Systems-PSV-2020-0254 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45666 · Vendor Advisory
• https://t.me/cvenotify/24985 · Telegram Post