PT-2021-6195 · NetGear · Netgear Ms60+12

Published 2021-12-21 · Updated 2022-01-06 · CVE-2021-45669

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions NETGEAR RAX200 versions prior to 1.0.3.106 NETGEAR MR60 versions prior to 1.0.6.110 NETGEAR RAX20 versions prior to 1.0.2.82 NETGEAR RAX45 versions prior to 1.0.2.72 NETGEAR RAX80 versions prior to 1.0.3.106 NETGEAR MS60 versions prior to 1.0.6.110 NETGEAR RAX15 versions prior to 1.0.2.82 NETGEAR RAX50 versions prior to 1.0.2.72 NETGEAR RAX75 versions prior to 1.0.3.106 NETGEAR RBR750 versions prior to 3.2.16.6 NETGEAR RBR850 versions prior to 3.2.16.6 NETGEAR RBS750 versions prior to 3.2.16.6 NETGEAR RBS850 versions prior to 3.2.16.6 NETGEAR RBK752 versions prior to 3.2.16.6 NETGEAR RBK852 versions prior to 3.2.16.6

Description The issue is related to stored XSS in certain NETGEAR devices. This occurs due to inadequate protection of the web page structure, allowing a remote attacker to impact the confidentiality and integrity of protected information.

Recommendations For NETGEAR RAX200 versions prior to 1.0.3.106, update to version 1.0.3.106 or later. For NETGEAR MR60 versions prior to 1.0.6.110, update to version 1.0.6.110 or later. For NETGEAR RAX20 versions prior to 1.0.2.82, update to version 1.0.2.82 or later. For NETGEAR RAX45 versions prior to 1.0.2.72, update to version 1.0.2.72 or later. For NETGEAR RAX80 versions prior to 1.0.3.106, update to version 1.0.3.106 or later. For NETGEAR MS60 versions prior to 1.0.6.110, update to version 1.0.6.110 or later. For NETGEAR RAX15 versions prior to 1.0.2.82, update to version 1.0.2.82 or later. For NETGEAR RAX50 versions prior to 1.0.2.72, update to version 1.0.2.72 or later. For NETGEAR RAX75 versions prior to 1.0.3.106, update to version 1.0.3.106 or later. For NETGEAR RBR750 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBR850 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBS750 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBS850 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBK752 versions prior to 3.2.16.6, update to version 3.2.16.6 or later. For NETGEAR RBK852 versions prior to 3.2.16.6, update to version 3.2.16.6 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-01111

CVE-2021-45669

Affected Products

Netgear Ms60

Netgear Rax15

Netgear Rax20

Netgear Rax200

Netgear Rax45

Netgear Rax50

Netgear Rax75

Netgear Rax80

Netgear Rbk752

Netgear Rbk852

Netgear Rbr750

Netgear Rbr850

Netgear Rbs750

References · 5

• https://kb.netgear.com/000064478/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-WiFi-Systems-PSV-2020-0210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45669 · Security Note
• https://bdu.fstec.ru/vul/2022-01111 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45669 · Vendor Advisory
• https://t.me/cibsecurity/34639 · Telegram Post