PT-2021-5913 · NetGear · Netgear R7450+22

Aircut · Published 2021-09-25 · Updated 2022-07-12 · CVE-2021-45656

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR D6200 versions before 1.1.00.38 NETGEAR D7000 versions before 1.0.1.78 NETGEAR R6020 versions before 1.0.0.48 NETGEAR R6080 versions before 1.0.0.48 NETGEAR R6050 versions before 1.0.1.26 NETGEAR JR6150 versions before 1.0.1.26 NETGEAR R6120 versions before 1.0.0.66 NETGEAR R6220 versions before 1.1.0.100 NETGEAR R6230 versions before 1.1.0.100 NETGEAR R6260 versions before 1.1.0.78 NETGEAR R6800 versions before 1.2.0.76 NETGEAR R6900v2 versions before 1.2.0.76 NETGEAR R6700v2 versions before 1.2.0.76 NETGEAR R7450 versions before 1.2.0.76 NETGEAR AC2100 versions before 1.2.0.76 NETGEAR AC2400 versions before 1.2.0.76 NETGEAR AC2600 versions before 1.2.0.76 NETGEAR RBK40 versions before 2.5.1.16 NETGEAR RBR40 versions before 2.5.1.16 NETGEAR RBS40 versions before 2.5.1.16 NETGEAR RBK20 versions before 2.5.1.16 NETGEAR RBR20 versions before 2.5.1.16 NETGEAR RBS20 versions before 2.5.1.16 NETGEAR RBK50 versions before 2.5.1.16 NETGEAR RBR50 versions before 2.5.1.16 NETGEAR RBS50 versions before 2.5.1.16 NETGEAR RBS50Y versions before 2.6.1.40

Description The issue is related to incorrect management of code generation, which can allow an attacker to perform a server-side injection attack. This type of attack can be executed through vulnerable API endpoints, although specific endpoint details are not provided. The vulnerability is associated with the Server Side Include Injection (SSI) attack type.

Recommendations Update NETGEAR D6200 to version 1.1.00.38 or later Update NETGEAR D7000 to version 1.0.1.78 or later Update NETGEAR R6020 to version 1.0.0.48 or later Update NETGEAR R6080 to version 1.0.0.48 or later Update NETGEAR R6050 to version 1.0.1.26 or later Update NETGEAR JR6150 to version 1.0.1.26 or later Update NETGEAR R6120 to version 1.0.0.66 or later Update NETGEAR R6220 to version 1.1.0.100 or later Update NETGEAR R6230 to version 1.1.0.100 or later Update NETGEAR R6260 to version 1.1.0.78 or later Update NETGEAR R6800 to version 1.2.0.76 or later Update NETGEAR R6900v2 to version 1.2.0.76 or later Update NETGEAR R6700v2 to version 1.2.0.76 or later Update NETGEAR R7450 to version 1.2.0.76 or later Update NETGEAR AC2100 to version 1.2.0.76 or later Update NETGEAR AC2400 to version 1.2.0.76 or later Update NETGEAR AC2600 to version 1.2.0.76 or later Update NETGEAR RBK40 to version 2.5.1.16 or later Update NETGEAR RBR40 to version 2.5.1.16 or later Update NETGEAR RBS40 to version 2.5.1.16 or later Update NETGEAR RBK20 to version 2.5.1.16 or later Update NETGEAR RBR20 to version 2.5.1.16 or later Update NETGEAR RBS20 to version 2.5.1.16 or later Update NETGEAR RBK50 to version 2.5.1.16 or later Update NETGEAR RBR50 to version 2.5.1.16 or later Update NETGEAR RBS50 to version 2.5.1.16 or later Update NETGEAR RBS50Y to version 2.6.1.40 or later

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

BDU:2022-00428

CVE-2021-45656

Affected Products

Netgear Ac2100

Netgear Ac2400

Netgear Ac2600

Netgear D6200

Netgear R7000

Netgear Jr6150

Netgear R6020

Netgear R6050

Netgear R6080

Netgear R6120

Netgear R6220

Netgear R6230

Netgear R6260

Netgear R6700V2

Netgear R6800

Netgear R6900V2

Netgear R7450

Netgear Rbr20

Netgear Rbk40

Netgear Rbr50

Netgear Cbr40

Netgear Rbs40

Netgear Rbs50

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-45656 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45656 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00428 · Security Note
• https://kb.netgear.com/000064066/Security-Advisory-for-Server-Side-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2019-0140 · Vendor Advisory
• https://t.me/cvenotify/24930 · Telegram Post