PT-2021-6196 · NetGear · Netgear Rbr50+4

Goushibee · Published 2021-12-21 · Updated 2022-01-05 · CVE-2021-45593

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR RBR20 versions prior to 2.7.3.22 NETGEAR RBR40 versions prior to 2.7.3.22 NETGEAR RBR50 versions prior to 2.7.2.102 NETGEAR RBS20 versions prior to 2.7.3.22 NETGEAR RBS40 versions prior to 2.7.3.22 NETGEAR RBK20 versions prior to 2.7.3.22 NETGEAR RBK40 versions prior to 2.7.3.22 NETGEAR RBK50 versions prior to 2.7.2.102

Description The issue is related to command injection by an authenticated user, which can be exploited due to the lack of input data sanitization. This allows a remote attacker to execute arbitrary commands.

Recommendations For RBR20 versions prior to 2.7.3.22, update to version 2.7.3.22 or later. For RBR40 versions prior to 2.7.3.22, update to version 2.7.3.22 or later. For RBR50 versions prior to 2.7.2.102, update to version 2.7.2.102 or later. For RBS20 versions prior to 2.7.3.22, update to version 2.7.3.22 or later. For RBS40 versions prior to 2.7.3.22, update to version 2.7.3.22 or later. For RBK20 versions prior to 2.7.3.22, update to version 2.7.3.22 or later. For RBK40 versions prior to 2.7.3.22, update to version 2.7.3.22 or later. For RBK50 versions prior to 2.7.2.102, update to version 2.7.2.102 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-01112

CVE-2021-45593

Affected Products

Netgear Rbr20

Netgear Rbk40

Netgear Rbr50

Netgear Cbr40

Netgear Rbs40

References · 4

• https://bdu.fstec.ru/vul/2022-01112 · Security Note
• https://kb.netgear.com/000064474/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45593 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45593 · Vendor Advisory