PT-2021-6212 · NetGear · Netgear R7000P+2

Published 2021-12-21 · Updated 2022-01-05 · CVE-2021-45625

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NETGEAR XR300 versions prior to 1.0.3.68 NETGEAR R7000P versions prior to 1.3.3.140 NETGEAR R6900P versions prior to 1.3.3.140

Description The issue is related to command injection by an unauthenticated attacker due to the lack of input data sanitization in the embedded software of certain NETGEAR devices. This allows a remote attacker to execute arbitrary commands.

Recommendations For NETGEAR XR300 versions prior to 1.0.3.68, update to version 1.0.3.68 or later. For NETGEAR R7000P versions prior to 1.3.3.140, update to version 1.3.3.140 or later. For NETGEAR R6900P versions prior to 1.3.3.140, update to version 1.3.3.140 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-01128

CVE-2021-45625

Affected Products

Netgear R6900P

Netgear R7000P

Netgear Xr300

References · 5

• https://osv.dev/vulnerability/CVE-2021-45625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45625 · Security Note
• https://kb.netgear.com/000064489/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0371 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01128 · Security Note
• https://t.me/cvenotify/24940 · Telegram Post