PT-2021-5907 · NetGear · R7900+10

Published 2021-12-21 · Updated 2022-01-06 · CVE-2021-45624

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR D7000v2 versions prior to 1.0.0.66 NETGEAR D8500 versions prior to 1.0.3.58 NETGEAR R7000 versions prior to 1.0.11.110 NETGEAR R7100LG versions prior to 1.0.0.72 NETGEAR R7900 versions prior to 1.0.4.30 NETGEAR R8000 versions prior to 1.0.4.62 NETGEAR XR300 versions prior to 1.0.3.56 NETGEAR R7000P versions prior to 1.3.2.132 NETGEAR R8500 versions prior to 1.0.2.144 NETGEAR R6900P versions prior to 1.3.2.132 NETGEAR R8300 versions prior to 1.0.2.144

Description The issue is related to command injection by an unauthenticated attacker due to the lack of input data sanitization in the embedded software of NETGEAR Wi-Fi routers. This allows a remote attacker to execute arbitrary commands.

Recommendations For NETGEAR D7000v2 version prior to 1.0.0.66, update to version 1.0.0.66 or later. For NETGEAR D8500 version prior to 1.0.3.58, update to version 1.0.3.58 or later. For NETGEAR R7000 version prior to 1.0.11.110, update to version 1.0.11.110 or later. For NETGEAR R7100LG version prior to 1.0.0.72, update to version 1.0.0.72 or later. For NETGEAR R7900 version prior to 1.0.4.30, update to version 1.0.4.30 or later. For NETGEAR R8000 version prior to 1.0.4.62, update to version 1.0.4.62 or later. For NETGEAR XR300 version prior to 1.0.3.56, update to version 1.0.3.56 or later. For NETGEAR R7000P version prior to 1.3.2.132, update to version 1.3.2.132 or later. For NETGEAR R8500 version prior to 1.0.2.144, update to version 1.0.2.144 or later. For NETGEAR R6900P version prior to 1.3.2.132, update to version 1.3.2.132 or later. For NETGEAR R8300 version prior to 1.0.2.144, update to version 1.0.2.144 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-00422

CVE-2021-45624

Affected Products

D7000V2

D8500

R6900P

R7000

R7000P

R7100Lg

R7900

R8000

R8300

R8500

Xr300

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-45624 · Security Note
• https://kb.netgear.com/000064485/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0298 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00422 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45624 · Vendor Advisory
• https://t.me/cvenotify/24984 · Telegram Post