PT-2021-5929 · NetGear · Ex6120+47

Published 2021-12-22 · Updated 2022-01-10 · CVE-2021-45621

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR CBR40 versions prior to 2.5.0.24 NETGEAR CBR750 versions prior to 3.2.18.2 NETGEAR EAX20 versions prior to 1.0.0.58 NETGEAR EAX80 versions prior to 1.0.1.68 NETGEAR EX3700 versions prior to 1.0.0.94 NETGEAR EX3800 versions prior to 1.0.0.94 NETGEAR EX6120 versions prior to 1.0.0.64 NETGEAR EX6130 versions prior to 1.0.0.44 NETGEAR EX7000 versions prior to 1.0.1.104 NETGEAR EX7500 versions prior to 1.0.0.74 NETGEAR LAX20 versions prior to 1.1.6.28 NETGEAR MR60 versions prior to 1.0.6.116 NETGEAR MS60 versions prior to 1.0.6.116 NETGEAR R6300v2 versions prior to 1.0.4.52 NETGEAR R6400 versions prior to 1.0.1.70 NETGEAR R6400v2 versions prior to 1.0.4.106 NETGEAR R6700v3 versions prior to 1.0.4.106 NETGEAR R6900P versions prior to 1.3.3.140 NETGEAR R7000 versions prior to 1.0.11.126 NETGEAR R7000P versions prior to 1.3.3.140 NETGEAR R7100LG versions prior to 1.0.0.72 NETGEAR R7850 versions prior to 1.0.5.74 NETGEAR R7900 versions prior to 1.0.4.46 NETGEAR R7900P versions prior to 1.4.2.84 NETGEAR R7960P versions prior to 1.4.2.84 NETGEAR R8000 versions prior to 1.0.4.74 NETGEAR R8000P versions prior to 1.4.2.84 NETGEAR R8300 versions prior to 1.0.2.154 NETGEAR R8500 versions prior to 1.0.2.154 NETGEAR RAX15 versions prior to 1.0.3.96 NETGEAR RAX20 versions prior to 1.0.3.96 NETGEAR RAX200 versions prior to 1.0.4.120 NETGEAR RAX35v2 versions prior to 1.0.3.96 NETGEAR RAX40v2 versions prior to 1.0.3.96 NETGEAR RAX43 versions prior to 1.0.3.96 NETGEAR RAX45 versions prior to 1.0.3.96 NETGEAR RAX50 versions prior to 1.0.3.96 NETGEAR RAX75 versions prior to 1.0.4.120 NETGEAR RAX80 versions prior to 1.0.4.120 NETGEAR RBK752 versions prior to 3.2.17.12 NETGEAR RBK852 versions prior to 3.2.17.12 NETGEAR RBR750 versions prior to 3.2.17.12 NETGEAR RBR850 versions prior to 3.2.17.12 NETGEAR RBS750 versions prior to 3.2.17.12 NETGEAR RBS850 versions prior to 3.2.17.12 NETGEAR RS400 versions prior to 1.5.1.80 NETGEAR XR1000 versions prior to 1.0.0.58 NETGEAR XR300 versions prior to 1.0.3.68

Description The issue is related to insufficient input data cleaning, which may allow a remote attacker to execute arbitrary commands. This is a command injection vulnerability that can be exploited by an unauthenticated attacker.

Recommendations For NETGEAR CBR40 versions prior to 2.5.0.24, update to version 2.5.0.24 or later. For NETGEAR CBR750 versions prior to 3.2.18.2, update to version 3.2.18.2 or later. For NETGEAR EAX20 versions prior to 1.0.0.58, update to version 1.0.0.58 or later. For NETGEAR EAX80 versions prior to 1.0.1.68, update to version 1.0.1.68 or later. For NETGEAR EX3700 versions prior to 1.0.0.94, update to version 1.0.0.94 or later. For NETGEAR EX3800 versions prior to 1.0.0.94, update to version 1.0.0.94 or later. For NETGEAR EX6120 versions prior to 1.0.0.64, update to version 1.0.0.64 or later. For NETGEAR EX6130 versions prior to 1.0.0.44, update to version 1.0.0.44 or later. For NETGEAR EX7000 versions prior to 1.0.1.104, update to version 1.0.1.104 or later. For NETGEAR EX7500 versions prior to 1.0.0.74, update to version 1.0.0.74 or later. For NETGEAR LAX20 versions prior to 1.1.6.28, update to version 1.1.6.28 or later. For NETGEAR MR60 versions prior to 1.0.6.116, update to version 1.0.6.116 or later. For NETGEAR MS60 versions prior to 1.0.6.116, update to version 1.0.6.116 or later. For NETGEAR R6300v2 versions prior to 1.0.4.52, update to version 1.0.4.52 or later. For NETGEAR R6400 versions prior to 1.0.1.70, update to version 1.0.1.70 or later. For NETGEAR R6400v2 versions prior to 1.0.4.106, update to version 1.0.4.106 or later. For NETGEAR R6700v3 versions prior to 1.0.4.106, update to version 1.0.4.106 or later. For NETGEAR R6900P versions prior to 1.3.3.140, update to version 1.3.3.140 or later. For NETGEAR R7000 versions prior to 1.0.11.126, update to version 1.0.11.126 or later. For NETGEAR R7000P versions prior to 1.3.3.140, update to version 1.3.3.140 or later. For NETGEAR R7100LG versions prior to 1.0.0.72, update to version 1.0.0.72 or later. For NETGEAR R7850 versions prior to 1.0.5.74, update to version 1.0.5.74 or later. For NETGEAR R7900 versions prior to 1.0.4.46, update to version 1.0.4.46 or later. For NETGEAR R7900P versions prior to 1.4.2.84, update to version 1.4.2.84 or later. For NETGEAR R7960P versions prior to 1.4.2.84, update to version 1.4.2.84 or later. For NETGEAR R8000 versions prior to 1.0.4.74, update to version 1.0.4.74 or later. For NETGEAR R8000P versions prior to 1.4.2.84, update to version 1.4.2.84 or later. For NETGEAR R8300 versions prior to 1.0.2.154, update to version 1.0.2.154 or later. For NETGEAR R8500 versions prior to 1.0.2.154, update to version 1.0.2.154 or later. For NETGEAR RAX15 versions prior to 1.0.3.96, update to version 1.0.3.96 or later. For NETGEAR RAX20 versions prior to 1.0.3.96, update to version 1.0.3.96 or later. For NETGEAR RAX200 versions prior to 1.0.4.120, update to version 1.0.4.120 or later. For NETGEAR RAX35v2 versions prior to 1.0.3.96, update to version 1.0.3.96 or later. For NETGEAR RAX40v2 versions prior to 1.0.3.96, update to version 1.0.3.96 or later. For NETGEAR RAX43 versions prior to 1.0.3.96, update to version 1.0.3.96 or later. For NETGEAR RAX45 versions prior to 1.0.3.96, update to version 1.0.3.96 or later. For NETGEAR RAX50 versions prior to 1.0.3.96, update to version 1.0.3.96 or later. For NETGEAR RAX75 versions prior to 1.0.4.120, update to version 1.0.4.120 or later. For NETGEAR RAX80 versions prior to 1.0.4.120, update to version 1.0.4.120 or later. For NETGEAR RBK752 versions prior to 3.2.17.12, update to version 3.2.17.12 or later. For NETGEAR RBK852 versions prior to 3.2.17.12, update to version 3.2.17.12 or later. For NETGEAR RBR750 versions prior to 3.2.17.12, update to version 3.2.17.12 or later. For NETGEAR RBR850 versions prior to 3.2.17.12, update to version 3.2.17.12 or later. For NETGEAR RBS750 versions prior to 3.2.17.12, update to version 3.2.17.12 or later. For NETGEAR RBS850 versions prior to 3.2.17.12, update to version 3.2.17.12 or later. For NETGEAR RS400 versions prior to 1.5.1.80, update to version 1.5.1.80 or later. For NETGEAR XR1000 versions prior to 1.0.0.58, update to version 1.0.0.58 or later. For NETGEAR XR300 versions prior to 1.0.3.68, update to version 1.0.3.68 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-00444

CVE-2021-45621

Affected Products

Cbr40

Cbr750

Eax20

Eax80

Ex3700

Ex3800

Ex6120

Ex6130

Ex7000

Ex7500

Lax20

Mr60

Ms60

R6300V2

R6400

R6400V2

R6700V3

R6900P

R7000

R7000P

R7100Lg

R7850

R7900

R7900P

R7960P

R8000

R8000P

R8300

R8500

Rax15

Rax20

Rax200

Rax35V2

Rax40V2

Rax43

Rax45

Rax50

Rax75

Rax80

Rbk752

Rbk852

Rbr750

Rbr850

Rbs750

Rbs850

Rs400

Xr1000

Xr300

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-45621 · Security Note
• https://bdu.fstec.ru/vul/2022-00444 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45621 · Vendor Advisory
• https://kb.netgear.com/000064523/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0562 · Vendor Advisory