PT-2021-5881 · NetGear · Xr700+17

Kevin Breen · Published 2021-09-02 · Updated 2022-01-06 · CVE-2021-45603

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AC:L/AV:L/A:L/C:H/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR D7800 versions prior to 1.0.1.66 NETGEAR EX2700 versions prior to 1.0.1.68 NETGEAR WN3000RPv2 versions prior to 1.0.0.90 NETGEAR WN3000RPv3 versions prior to 1.0.2.100 NETGEAR LBR1020 versions prior to 2.6.5.20 NETGEAR LBR20 versions prior to 2.6.5.32 NETGEAR R6700AX versions prior to 1.0.10.110 NETGEAR R7800 versions prior to 1.0.2.86 NETGEAR R8900 versions prior to 1.0.5.38 NETGEAR R9000 versions prior to 1.0.5.38 NETGEAR RAX10 versions prior to 1.0.10.110 NETGEAR RAX120v1 versions prior to 1.2.3.28 NETGEAR RAX120v2 versions prior to 1.2.3.28 NETGEAR RAX70 versions prior to 1.0.10.110 NETGEAR RAX78 versions prior to 1.0.10.110 NETGEAR XR450 versions prior to 2.3.2.130 NETGEAR XR500 versions prior to 2.3.2.130 NETGEAR XR700 versions prior to 1.0.1.46

Description The issue is related to the disclosure of sensitive information in certain NETGEAR devices. A UPnP request can reveal a device's serial number, which can then be used for a password reset. This is due to insufficient protection of service data, allowing an attacker to gain unauthorized access to protected information or execute arbitrary commands.

Recommendations For NETGEAR D7800 version prior to 1.0.1.66, update to version 1.0.1.66 or later. For NETGEAR EX2700 version prior to 1.0.1.68, update to version 1.0.1.68 or later. For NETGEAR WN3000RPv2 version prior to 1.0.0.90, update to version 1.0.0.90 or later. For NETGEAR WN3000RPv3 version prior to 1.0.2.100, update to version 1.0.2.100 or later. For NETGEAR LBR1020 version prior to 2.6.5.20, update to version 2.6.5.20 or later. For NETGEAR LBR20 version prior to 2.6.5.32, update to version 2.6.5.32 or later. For NETGEAR R6700AX version prior to 1.0.10.110, update to version 1.0.10.110 or later. For NETGEAR R7800 version prior to 1.0.2.86, update to version 1.0.2.86 or later. For NETGEAR R8900 version prior to 1.0.5.38, update to version 1.0.5.38 or later. For NETGEAR R9000 version prior to 1.0.5.38, update to version 1.0.5.38 or later. For NETGEAR RAX10 version prior to 1.0.10.110, update to version 1.0.10.110 or later. For NETGEAR RAX120v1 version prior to 1.2.3.28, update to version 1.2.3.28 or later. For NETGEAR RAX120v2 version prior to 1.2.3.28, update to version 1.2.3.28 or later. For NETGEAR RAX70 version prior to 1.0.10.110, update to version 1.0.10.110 or later. For NETGEAR RAX78 version prior to 1.0.10.110, update to version 1.0.10.110 or later. For NETGEAR XR450 version prior to 2.3.2.130, update to version 2.3.2.130 or later. For NETGEAR XR500 version prior to 2.3.2.130, update to version 2.3.2.130 or later. For NETGEAR XR700 version prior to 1.0.1.46, update to version 1.0.1.46 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-00396

CVE-2021-45603

Affected Products

D7800

Ex2700

Lbr1020

Lbr20

R6700Ax

R7800

R8900

R9000

Rax10

Rax120V1

Rax120V2

Rax70

Rax78

Wn3000Rpv2

Wn3000Rpv3

Xr450

Xr500

Xr700

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-45603 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45603 · Vendor Advisory
• https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00396 · Security Note
• https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk · Note