PT-2021-6211 · NetGear · Netgear R6400

Published 2021-09-25 · Updated 2022-07-12 · CVE-2021-45655

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AC:L/AV:A/A:H/C:N/I:L/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR R6400 devices before 1.0.1.70

Description The issue is related to incorrect code generation management in the NETGEAR R6400 router's embedded software. This can allow a remote attacker to impact the integrity and availability of protected information. The problem is associated with server-side injection.

Recommendations For NETGEAR R6400 devices before 1.0.1.70, update to version 1.0.1.70 or later to resolve the issue. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

BDU:2022-01127

CVE-2021-45655

Affected Products

Netgear R6400

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-45655 · Security Note
• https://kb.netgear.com/000064069/Security-Advisory-for-Server-Side-Injection-on-R6400-PSV-2019-0178 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01127 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45655 · Vendor Advisory
• https://t.me/cvenotify/24931 · Telegram Post
• https://t.me/cvenotify/24960 · Telegram Post
• https://t.me/cibsecurity/34628 · Telegram Post