PT-2021-5904 · NetGear · Rbs40+41

Published

2021-12-21

·

Updated

2022-01-10

·

CVE-2021-45619

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions NETGEAR EX6200v2 versions 1.0.1.86 and earlier NETGEAR EX6250 versions 1.0.0.134 and earlier NETGEAR EX7700 versions 1.0.0.216 and earlier NETGEAR EX8000 versions 1.0.1.232 and earlier NETGEAR LBR1020 versions 2.6.3.58 and earlier NETGEAR LBR20 versions 2.6.3.50 and earlier NETGEAR R7800 versions 1.0.2.80 and earlier NETGEAR R8900 versions 1.0.5.26 and earlier NETGEAR R9000 versions 1.0.5.26 and earlier NETGEAR RBS50Y versions 2.7.3.22 and earlier NETGEAR WNR2000v5 versions 1.0.0.76 and earlier NETGEAR XR700 versions 1.0.1.36 and earlier NETGEAR EX6150v2 versions 1.0.1.98 and earlier NETGEAR EX7300 versions 1.0.2.158 and earlier NETGEAR EX7320 versions 1.0.0.134 and earlier NETGEAR RAX10 versions 1.0.2.88 and earlier NETGEAR RAX120 versions 1.2.0.16 and earlier NETGEAR RAX70 versions 1.0.2.88 and earlier NETGEAR EX6100v2 versions 1.0.1.98 and earlier NETGEAR EX6400 versions 1.0.2.158 and earlier NETGEAR EX7300v2 versions 1.0.0.134 and earlier NETGEAR R6700AX versions 1.0.2.88 and earlier NETGEAR RAX120v2 versions 1.2.0.16 and earlier NETGEAR RAX78 versions 1.0.2.88 and earlier NETGEAR EX6410 versions 1.0.0.134 and earlier NETGEAR RBR10 versions 2.7.3.22 and earlier NETGEAR RBR20 versions 2.7.3.22 and earlier NETGEAR RBR350 versions 4.3.4.7 and earlier NETGEAR RBR40 versions 2.7.3.22 and earlier NETGEAR RBR50 versions 2.7.3.22 and earlier NETGEAR EX6420 versions 1.0.0.134 and earlier NETGEAR RBS10 versions 2.7.3.22 and earlier NETGEAR RBS20 versions 2.7.3.22 and earlier NETGEAR RBS350 versions 4.3.4.7 and earlier NETGEAR RBS40 versions 2.7.3.22 and earlier NETGEAR RBS50 versions 2.7.3.22 and earlier NETGEAR EX6400v2 versions 1.0.0.134 and earlier NETGEAR RBK12 versions 2.7.3.22 and earlier NETGEAR RBK20 versions 2.7.3.22 and earlier NETGEAR RBK352 versions 4.3.4.7 and earlier NETGEAR RBK40 versions 2.7.3.22 and earlier NETGEAR RBK50 versions 2.7.3.22 and earlier
Description The issue is related to command injection by an unauthenticated attacker due to insufficient input validation in the embedded software of NETGEAR Wi-Fi routers. This allows a remote attacker to execute arbitrary commands.
Recommendations Update EX6200v2 to version 1.0.1.86 or later Update EX6250 to version 1.0.0.134 or later Update EX7700 to version 1.0.0.216 or later Update EX8000 to version 1.0.1.232 or later Update LBR1020 to version 2.6.3.58 or later Update LBR20 to version 2.6.3.50 or later Update R7800 to version 1.0.2.80 or later Update R8900 to version 1.0.5.26 or later Update R9000 to version 1.0.5.26 or later Update RBS50Y to version 2.7.3.22 or later Update WNR2000v5 to version 1.0.0.76 or later Update XR700 to version 1.0.1.36 or later Update EX6150v2 to version 1.0.1.98 or later Update EX7300 to version 1.0.2.158 or later Update EX7320 to version 1.0.0.134 or later Update RAX10 to version 1.0.2.88 or later Update RAX120 to version 1.2.0.16 or later Update RAX70 to version 1.0.2.88 or later Update EX6100v2 to version 1.0.1.98 or later Update EX6400 to version 1.0.2.158 or later Update EX7300v2 to version 1.0.0.134 or later Update R6700AX to version 1.0.2.88 or later Update RAX120v2 to version 1.2.0.16 or later Update RAX78 to version 1.0.2.88 or later Update EX6410 to version 1.0.0.134 or later Update RBR10 to version 2.7.3.22 or later Update RBR20 to version 2.7.3.22 or later Update RBR350 to version 4.3.4.7 or later Update RBR40 to version 2.7.3.22 or later Update RBR50 to version 2.7.3.22 or later Update EX6420 to version 1.0.0.134 or later Update RBS10 to version 2.7.3.22 or later Update RBS20 to version 2.7.3.22 or later Update RBS350 to version 4.3.4.7 or later Update RBS40 to version 2.7.3.22 or later Update RBS50 to version 2.7.3.22 or later Update EX6400v2 to version 1.0.0.134 or later Update RBK12 to version 2.7.3.22 or later Update RBK20 to version 2.7.3.22 or later Update RBK352 to version 4.3.4.7 or later Update RBK40 to version 2.7.3.22 or later Update RBK50 to version 2.7.3.22 or later

Fix

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-00419
CVE-2021-45619

Affected Products

Ex6100V2
Ex6150V2
Ex6200V2
Ex6250
Ex6400
Ex6400V2
Ex6410
Ex6420
Ex7300
Ex7300V2
Ex7320
Ex7700
Ex8000
Lbr1020
Lbr20
R6700Ax
R7800
R8900
R9000
Rax10
Rax120
Rax120V2
Rax70
Rax78
Rbk12
Rbk20
Rbk352
Rbk40
Rbk50
Rbr10
Rbr20
Rbr350
Rbr40
Rbr50
Rbs10
Rbs20
Rbs350
Rbs40
Rbs50
Rbs50Y
Wnr2000V5
Xr700