PT-2021-5875 · NetGear · R7900+38

Published 2021-12-22 · Updated 2022-01-06 · CVE-2021-45604

Positive Technologies (AI Summary)

CVSS v2.0

5.7

Medium

Base vector

AV:A/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR CBR750 versions prior to 3.2.18.2 NETGEAR D6220 versions prior to 1.0.0.68 NETGEAR D6400 versions prior to 1.0.0.102 NETGEAR D8500 versions prior to 1.0.3.60 NETGEAR LAX20 versions prior to 1.1.6.28 NETGEAR MK62 versions prior to 1.0.6.116 NETGEAR MR60 versions prior to 1.0.6.116 NETGEAR MS60 versions prior to 1.0.6.116 NETGEAR R6300v2 versions prior to 1.0.4.50 NETGEAR R6400 versions prior to 1.0.1.68 NETGEAR R6400v2 versions prior to 1.0.4.118 NETGEAR R6700v3 versions prior to 1.0.4.118 NETGEAR R6900P versions prior to 1.3.3.140 NETGEAR R7000 versions prior to 1.0.11.116 NETGEAR R7000P versions prior to 1.3.3.140 NETGEAR R7850 versions prior to 1.0.5.68 NETGEAR R7900 versions prior to 1.0.4.38 NETGEAR R7900P versions prior to 1.4.2.84 NETGEAR R7960P versions prior to 1.4.2.84 NETGEAR R8000 versions prior to 1.0.4.68 NETGEAR R8000P versions prior to 1.4.2.84 NETGEAR RAX15 versions prior to 1.0.3.96 NETGEAR RAX20 versions prior to 1.0.3.96 NETGEAR RAX200 versions prior to 1.0.4.120 NETGEAR RAX35v2 versions prior to 1.0.3.96 NETGEAR RAX40v2 versions prior to 1.0.3.96 NETGEAR RAX43 versions prior to 1.0.3.96 NETGEAR RAX45 versions prior to 1.0.3.96 NETGEAR RAX50 versions prior to 1.0.3.96 NETGEAR RAX75 versions prior to 1.0.4.120 NETGEAR RAX80 versions prior to 1.0.4.120 NETGEAR RBK752 versions prior to 3.2.17.12 NETGEAR RBK852 versions prior to 3.2.17.12 NETGEAR RBR750 versions prior to 3.2.17.12 NETGEAR RBR850 versions prior to 3.2.17.12 NETGEAR RBS750 versions prior to 3.2.17.12 NETGEAR RBS850 versions prior to 3.2.17.12 NETGEAR RS400 versions prior to 1.5.1.80 NETGEAR XR1000 versions prior to 1.0.0.58

Description The issue is related to a stack-based buffer overflow that can be triggered by an authenticated user. This may allow a remote attacker to cause a denial of service. The vulnerability is associated with writing data beyond the buffer boundaries.

Recommendations Update NETGEAR CBR750 to version 3.2.18.2 or later Update NETGEAR D6220 to version 1.0.0.68 or later Update NETGEAR D6400 to version 1.0.0.102 or later Update NETGEAR D8500 to version 1.0.3.60 or later Update NETGEAR LAX20 to version 1.1.6.28 or later Update NETGEAR MK62 to version 1.0.6.116 or later Update NETGEAR MR60 to version 1.0.6.116 or later Update NETGEAR MS60 to version 1.0.6.116 or later Update NETGEAR R6300v2 to version 1.0.4.50 or later Update NETGEAR R6400 to version 1.0.1.68 or later Update NETGEAR R6400v2 to version 1.0.4.118 or later Update NETGEAR R6700v3 to version 1.0.4.118 or later Update NETGEAR R6900P to version 1.3.3.140 or later Update NETGEAR R7000 to version 1.0.11.116 or later Update NETGEAR R7000P to version 1.3.3.140 or later Update NETGEAR R7850 to version 1.0.5.68 or later Update NETGEAR R7900 to version 1.0.4.38 or later Update NETGEAR R7900P to version 1.4.2.84 or later Update NETGEAR R7960P to version 1.4.2.84 or later Update NETGEAR R8000 to version 1.0.4.68 or later Update NETGEAR R8000P to version 1.4.2.84 or later Update NETGEAR RAX15 to version 1.0.3.96 or later Update NETGEAR RAX20 to version 1.0.3.96 or later Update NETGEAR RAX200 to version 1.0.4.120 or later Update NETGEAR RAX35v2 to version 1.0.3.96 or later Update NETGEAR RAX40v2 to version 1.0.3.96 or later Update NETGEAR RAX43 to version 1.0.3.96 or later Update NETGEAR RAX45 to version 1.0.3.96 or later Update NETGEAR RAX50 to version 1.0.3.96 or later Update NETGEAR RAX75 to version 1.0.4.120 or later Update NETGEAR RAX80 to version 1.0.4.120 or later Update NETGEAR RBK752 to version 3.2.17.12 or later Update NETGEAR RBK852 to version 3.2.17.12 or later Update NETGEAR RBR750 to version 3.2.17.12 or later Update NETGEAR RBR850 to version 3.2.17.12 or later Update NETGEAR RBS750 to version 3.2.17.12 or later Update NETGEAR RBS850 to version 3.2.17.12 or later Update NETGEAR RS400 to version 1.5.1.80 or later Update NETGEAR XR1000 to version 1.0.0.58 or later

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-00390

CVE-2021-45604

Affected Products

Cbr750

D6220

D6400

D8500

Lax20

Mk62

Mr60

Ms60

R6300V2

R6400

R6400V2

R6700V3

R6900P

R7000

R7000P

R7850

R7900

R7900P

R7960P

R8000

R8000P

Rax15

Rax20

Rax200

Rax35V2

Rax40V2

Rax43

Rax45

Rax50

Rax75

Rax80

Rbk752

Rbk852

Rbr750

Rbr850

Rbs750

Rbs850

Rs400

Xr1000

References · 4

• https://kb.netgear.com/000064526/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2020-0572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45604 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45604 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00390 · Security Note