PT-2021-5949 · NetGear · R7900+41

Published 2021-12-22 · Updated 2022-01-07 · CVE-2021-45620

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR CBR40 versions prior to 2.5.0.24 NETGEAR CBR750 versions prior to 4.6.3.6 NETGEAR EAX20 versions prior to 1.0.0.58 NETGEAR EAX80 versions prior to 1.0.1.68 NETGEAR LAX20 versions prior to 1.1.6.28 NETGEAR MR60 versions prior to 1.0.6.116 NETGEAR MR80 versions prior to 1.1.2.20 NETGEAR MS60 versions prior to 1.0.6.116 NETGEAR MS80 versions prior to 1.1.2.20 NETGEAR MK62 versions prior to 1.0.6.116 NETGEAR MK83 versions prior to 1.1.2.20 NETGEAR R6400 versions prior to 1.0.1.70 NETGEAR R6400v2 versions prior to 1.0.4.106 NETGEAR R6700v3 versions prior to 1.0.4.106 NETGEAR R6900P versions prior to 1.3.3.140 NETGEAR R7000 versions prior to 1.0.11.126 NETGEAR R7000P versions prior to 1.3.3.140 NETGEAR R7850 versions prior to 1.0.5.74 NETGEAR R7900 versions prior to 1.0.4.46 NETGEAR R7900P versions prior to 1.4.2.84 NETGEAR R7960P versions prior to 1.4.2.84 NETGEAR R8000 versions prior to 1.0.4.74 NETGEAR R8000P versions prior to 1.4.2.84 NETGEAR RAX15 versions prior to 1.0.3.96 NETGEAR RAX20 versions prior to 1.0.3.96 NETGEAR RAX200 versions prior to 1.0.4.120 NETGEAR RAX35v2 versions prior to 1.0.3.96 NETGEAR RAX40v2 versions prior to 1.0.3.96 NETGEAR RAX43 versions prior to 1.0.3.96 NETGEAR RAX45 versions prior to 1.0.3.96 NETGEAR RAX50 versions prior to 1.0.3.96 NETGEAR RAX75 versions prior to 1.0.4.120 NETGEAR RAX80 versions prior to 1.0.4.120 NETGEAR RBK752 versions prior to 3.2.17.12 NETGEAR RBK852 versions prior to 3.2.17.12 NETGEAR RBR750 versions prior to 3.2.17.12 NETGEAR RBR850 versions prior to 3.2.17.12 NETGEAR RBS750 versions prior to 3.2.17.12 NETGEAR RBS850 versions prior to 3.2.17.12 NETGEAR RS400 versions prior to 1.5.1.80 NETGEAR XR1000 versions prior to 1.0.0.58 NETGEAR XR300 versions prior to 1.0.3.68

Description The issue is related to insufficient input data cleaning, which can allow a remote attacker to execute arbitrary commands. This is a result of command injection by an unauthenticated attacker.

Recommendations Update CBR40 to version 2.5.0.24 or later Update CBR750 to version 4.6.3.6 or later Update EAX20 to version 1.0.0.58 or later Update EAX80 to version 1.0.1.68 or later Update LAX20 to version 1.1.6.28 or later Update MR60 to version 1.0.6.116 or later Update MR80 to version 1.1.2.20 or later Update MS60 to version 1.0.6.116 or later Update MS80 to version 1.1.2.20 or later Update MK62 to version 1.0.6.116 or later Update MK83 to version 1.1.2.20 or later Update R6400 to version 1.0.1.70 or later Update R6400v2 to version 1.0.4.106 or later Update R6700v3 to version 1.0.4.106 or later Update R6900P to version 1.3.3.140 or later Update R7000 to version 1.0.11.126 or later Update R7000P to version 1.3.3.140 or later Update R7850 to version 1.0.5.74 or later Update R7900 to version 1.0.4.46 or later Update R7900P to version 1.4.2.84 or later Update R7960P to version 1.4.2.84 or later Update R8000 to version 1.0.4.74 or later Update R8000P to version 1.4.2.84 or later Update RAX15 to version 1.0.3.96 or later Update RAX20 to version 1.0.3.96 or later Update RAX200 to version 1.0.4.120 or later Update RAX35v2 to version 1.0.3.96 or later Update RAX40v2 to version 1.0.3.96 or later Update RAX43 to version 1.0.3.96 or later Update RAX45 to version 1.0.3.96 or later Update RAX50 to version 1.0.3.96 or later Update RAX75 to version 1.0.4.120 or later Update RAX80 to version 1.0.4.120 or later Update RBK752 to version 3.2.17.12 or later Update RBK852 to version 3.2.17.12 or later Update RBR750 to version 3.2.17.12 or later Update RBR850 to version 3.2.17.12 or later Update RBS750 to version 3.2.17.12 or later Update RBS850 to version 3.2.17.12 or later Update RS400 to version 1.5.1.80 or later Update XR1000 to version 1.0.0.58 or later Update XR300 to version 1.0.3.68 or later

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-00464

CVE-2021-45620

Affected Products

Cbr40

Cbr750

Eax20

Eax80

Lax20

Mk62

Mk83

Mr60

Mr80

Ms60

Ms80

R6400

R6400V2

R6700V3

R6900P

R7000

R7000P

R7850

R7900

R7900P

R7960P

R8000

R8000P

Rax15

Rax20

Rax200

Rax35V2

Rax40V2

Rax43

Rax45

Rax50

Rax75

Rax80

Rbk752

Rbk852

Rbr750

Rbr850

Rbs750

Rbs850

Rs400

Xr1000

Xr300

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-45620 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45620 · Vendor Advisory
• https://kb.netgear.com/000064510/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0509 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00464 · Security Note
• https://t.me/cvenotify/25123 · Telegram Post