PT-2021-6220 · NetGear · Netgear Rax43

Evan Grant + 1 · Published 2021-12-30 · Updated 2022-01-11 · CVE-2021-20169

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netgear RAX43 version 1.0.3.96

Description The issue is related to the transmission of data in cleartext through the web interface of the affected device. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information using HTTP requests. The device communicates via HTTP by default, which results in sensitive information, such as usernames and passwords, being transmitted in cleartext.

Recommendations For Netgear RAX43 version 1.0.3.96, consider configuring the device to use secure communication protocols, such as HTTPS, to protect sensitive information transmitted to and from the web interface. As a temporary workaround, restrict access to the web interface to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2022-01136

CVE-2021-20169

Affected Products

Netgear Rax43

References · 4

• https://bdu.fstec.ru/vul/2022-01136 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-20169 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20169 · Vendor Advisory
• https://tenable.com/security/research/tra-2021-55 · Note