PT-2021-6187 · NetGear · Netgear R7960P+2

Published 2021-12-21 · Updated 2022-01-04 · CVE-2021-45555

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NETGEAR R7900P versions prior to 1.4.2.84 NETGEAR R7960P versions prior to 1.4.2.84 NETGEAR R8000P versions prior to 1.4.2.84

Description The issue is related to command injection by an authenticated user due to a lack of input data sanitization in the embedded software of NETGEAR routers. This allows a remote attacker to execute arbitrary commands.

Recommendations For NETGEAR R7900P version prior to 1.4.2.84, update to version 1.4.2.84 or later. For NETGEAR R7960P version prior to 1.4.2.84, update to version 1.4.2.84 or later. For NETGEAR R8000P version prior to 1.4.2.84, update to version 1.4.2.84 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-01103

CVE-2021-45555

Affected Products

Netgear R7900

Netgear R7960P

Netgear R8000

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-45555 · Security Note
• https://kb.netgear.com/000064497/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0480 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-45555 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01103 · Security Note