PT-2021-6226 · NetGear · Netgear R7000+4

Published 2021-09-26 · Updated 2022-01-05 · CVE-2021-45649

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AC:L/AV:L/A:N/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR R6400v2 versions prior to 1.0.4.84 NETGEAR R6700v3 versions prior to 1.0.4.84 NETGEAR R7000 versions prior to 1.0.11.126 NETGEAR R6900P versions prior to 1.3.2.126 NETGEAR R7000P versions prior to 1.3.2.126

Description The issue is related to the lack of protection for service data in the embedded software of certain NETGEAR devices, which can allow an attacker to disclose sensitive information.

Recommendations For R6400v2 versions prior to 1.0.4.84, update to version 1.0.4.84 or later. For R6700v3 versions prior to 1.0.4.84, update to version 1.0.4.84 or later. For R7000 versions prior to 1.0.11.126, update to version 1.0.11.126 or later. For R6900P versions prior to 1.3.2.126, update to version 1.3.2.126 or later. For R7000P versions prior to 1.3.2.126, update to version 1.3.2.126 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2022-01151

CVE-2021-45649

Affected Products

Netgear R6400V2

Netgear R6700V3

Netgear R6900P

Netgear R7000

Netgear R7000P

References · 4

• https://bdu.fstec.ru/vul/2022-01151 · Security Note
• https://kb.netgear.com/000064073/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-PSV-2019-0123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45649 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45649 · Vendor Advisory