PT-2021-5956 · NetGear · Rbs40+28

Alxhh · Published 2021-12-21 · Updated 2022-01-12 · CVE-2021-45642

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AC:L/AV:A/A:L/C:L/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions D7800 versions prior to 1.0.1.64 EX6250 versions prior to 1.0.0.134 EX7700 versions prior to 1.0.0.222 LBR20 versions prior to 2.6.3.50 RBS50Y versions prior to 2.7.3.22 R8900 versions prior to 1.0.5.26 R9000 versions prior to 1.0.5.26 XR450 versions prior to 2.3.2.66 XR500 versions prior to 2.3.2.66 XR700 versions prior to 1.0.1.36 EX7320 versions prior to 1.0.0.134 RAX120 versions prior to 1.2.2.24 EX7300v2 versions prior to 1.0.0.134 RAX120v2 versions prior to 1.2.2.24 EX6410 versions prior to 1.0.0.134 RBR10 versions prior to 2.7.3.22 RBR20 versions prior to 2.7.3.22 RBR40 versions prior to 2.7.3.22 RBR50 versions prior to 2.7.3.22 EX6420 versions prior to 1.0.0.134 RBS10 versions prior to 2.7.3.22 RBS20 versions prior to 2.7.3.22 RBS40 versions prior to 2.7.3.22 RBS50 versions prior to 2.7.3.22 EX6400v2 versions prior to 1.0.0.134 RBK12 versions prior to 2.7.3.22 RBK20 versions prior to 2.7.3.22 RBK40 versions prior to 2.7.3.22 RBK50 versions prior to 2.7.3.22

Description The issue is related to incorrect configuration of security settings in certain NETGEAR devices. This may allow a remote attacker to impact the integrity, availability, and confidentiality of protected information.

Recommendations Update D7800 to version 1.0.1.64 or later Update EX6250 to version 1.0.0.134 or later Update EX7700 to version 1.0.0.222 or later Update LBR20 to version 2.6.3.50 or later Update RBS50Y to version 2.7.3.22 or later Update R8900 to version 1.0.5.26 or later Update R9000 to version 1.0.5.26 or later Update XR450 to version 2.3.2.66 or later Update XR500 to version 2.3.2.66 or later Update XR700 to version 1.0.1.36 or later Update EX7320 to version 1.0.0.134 or later Update RAX120 to version 1.2.2.24 or later Update EX7300v2 to version 1.0.0.134 or later Update RAX120v2 to version 1.2.2.24 or later Update EX6410 to version 1.0.0.134 or later Update RBR10 to version 2.7.3.22 or later Update RBR20 to version 2.7.3.22 or later Update RBR40 to version 2.7.3.22 or later Update RBR50 to version 2.7.3.22 or later Update EX6420 to version 1.0.0.134 or later Update RBS10 to version 2.7.3.22 or later Update RBS20 to version 2.7.3.22 or later Update RBS40 to version 2.7.3.22 or later Update RBS50 to version 2.7.3.22 or later Update EX6400v2 to version 1.0.0.134 or later Update RBK12 to version 2.7.3.22 or later Update RBK20 to version 2.7.3.22 or later Update RBK40 to version 2.7.3.22 or later Update RBK50 to version 2.7.3.22 or later

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2022-00474

CVE-2021-45642

Affected Products

D7800

Ex6250

Ex6400V2

Ex6410

Ex6420

Ex7300V2

Ex7320

Ex7700

Lbr20

R8900

R9000

Rax120

Rax120V2

Rbk12

Rbk20

Rbk40

Rbk50

Rbr10

Rbr20

Rbr40

Rbr50

Rbs10

Rbs20

Rbs40

Rbs50

Rbs50Y

Xr450

Xr500

Xr700

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-45642 · Security Note
• https://bdu.fstec.ru/vul/2022-00474 · Security Note
• https://kb.netgear.com/000064491/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0427 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45642 · Vendor Advisory
• https://t.me/cvenotify/25286 · Telegram Post