PT-2021-5868 · NetGear · R7900+33

K1Tten · Published 2021-09-26 · Updated 2022-01-10 · CVE-2021-45647

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NETGEAR EAX80 versions prior to 1.0.1.62 NETGEAR EX7000 versions prior to 1.0.1.104 NETGEAR R6120 versions prior to 1.0.0.76 NETGEAR R6220 versions prior to 1.1.0.110 NETGEAR R6230 versions prior to 1.1.0.110 NETGEAR R6260 versions prior to 1.1.0.78 NETGEAR R6850 versions prior to 1.1.0.78 NETGEAR R6350 versions prior to 1.1.0.78 NETGEAR R6330 versions prior to 1.1.0.78 NETGEAR R6800 versions prior to 1.2.0.76 NETGEAR R6900v2 versions prior to 1.2.0.76 NETGEAR R6700v2 versions prior to 1.2.0.76 NETGEAR R7000 versions prior to 1.0.11.116 NETGEAR R6900P versions prior to 1.3.3.140 NETGEAR R7000P versions prior to 1.3.3.140 NETGEAR R7200 versions prior to 1.2.0.76 NETGEAR R7350 versions prior to 1.2.0.76 NETGEAR R7400 versions prior to 1.2.0.76 NETGEAR R7450 versions prior to 1.2.0.76 NETGEAR AC2100 versions prior to 1.2.0.76 NETGEAR AC2400 versions prior to 1.2.0.76 NETGEAR AC2600 versions prior to 1.2.0.76 NETGEAR R7900 versions prior to 1.0.4.38 NETGEAR R7960P versions prior to 1.4.1.66 NETGEAR R8000 versions prior to 1.0.4.68 NETGEAR R7900P versions prior to 1.4.1.66 NETGEAR R8000P versions prior to 1.4.1.66 NETGEAR RAX15 versions prior to 1.0.2.82 NETGEAR RAX20 versions prior to 1.0.2.82 NETGEAR RAX200 versions prior to 1.0.3.106 NETGEAR RAX45 versions prior to 1.0.2.72 NETGEAR RAX50 versions prior to 1.0.2.72 NETGEAR RAX75 versions prior to 1.0.3.106 NETGEAR RAX80 versions prior to 1.0.3.106

Description The issue is related to insufficient protection of service data in NETGEAR network devices, which may allow a remote attacker to gain unauthorized access to protected information.

Recommendations Update EAX80 to version 1.0.1.62 or later Update EX7000 to version 1.0.1.104 or later Update R6120 to version 1.0.0.76 or later Update R6220 to version 1.1.0.110 or later Update R6230 to version 1.1.0.110 or later Update R6260 to version 1.1.0.78 or later Update R6850 to version 1.1.0.78 or later Update R6350 to version 1.1.0.78 or later Update R6330 to version 1.1.0.78 or later Update R6800 to version 1.2.0.76 or later Update R6900v2 to version 1.2.0.76 or later Update R6700v2 to version 1.2.0.76 or later Update R7000 to version 1.0.11.116 or later Update R6900P to version 1.3.3.140 or later Update R7000P to version 1.3.3.140 or later Update R7200 to version 1.2.0.76 or later Update R7350 to version 1.2.0.76 or later Update R7400 to version 1.2.0.76 or later Update R7450 to version 1.2.0.76 or later Update AC2100 to version 1.2.0.76 or later Update AC2400 to version 1.2.0.76 or later Update AC2600 to version 1.2.0.76 or later Update R7900 to version 1.0.4.38 or later Update R7960P to version 1.4.1.66 or later Update R8000 to version 1.0.4.68 or later Update R7900P to version 1.4.1.66 or later Update R8000P to version 1.4.1.66 or later Update RAX15 to version 1.0.2.82 or later Update RAX20 to version 1.0.2.82 or later Update RAX200 to version 1.0.3.106 or later Update RAX45 to version 1.0.2.72 or later Update RAX50 to version 1.0.2.72 or later Update RAX75 to version 1.0.3.106 or later Update RAX80 to version 1.0.3.106 or later

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-00383

CVE-2021-45647

Affected Products

Ac2100

Ac2400

Ac2600

Eax80

Ex7000

R6120

R6220

R6230

R6260

R6330

R6350

R6700V2

R6800

R6850

R6900P

R6900V2

R7000

R7000P

R7200

R7350

R7400

R7450

R7900

R7900P

R7960P

R8000

R8000P

Rax15

Rax20

Rax200

Rax45

Rax50

Rax75

Rax80

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-45647 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45647 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00383 · Security Note
• https://kb.netgear.com/000064118/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-and-Extenders-PSV-2020-0184 · Vendor Advisory