PT-2021-6259 · NetGear · Netgear R7000+6

K1Tten · Published 2021-09-26 · Updated 2022-01-04 · CVE-2021-45554

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AC:L/AV:A/A:H/C:H/I:H/PR:H/S:C/UI:N

Name of the Vulnerable Software and Affected Versions NETGEAR R6400 versions prior to 1.0.1.74 NETGEAR R6400v2 versions prior to 1.0.4.118 NETGEAR R6700v3 versions prior to 1.0.4.118 NETGEAR R7000 versions prior to 1.0.11.126 NETGEAR R6900P versions prior to 1.3.3.140 NETGEAR R7000P versions prior to 1.3.3.140 NETGEAR R8000 versions prior to 1.0.4.74

Description The issue is related to command injection by an authenticated user due to the lack of input data sanitization. This allows a remote attacker to execute arbitrary commands.

Recommendations For NETGEAR R6400 version prior to 1.0.1.74, update to version 1.0.1.74 or later. For NETGEAR R6400v2 version prior to 1.0.4.118, update to version 1.0.4.118 or later. For NETGEAR R6700v3 version prior to 1.0.4.118, update to version 1.0.4.118 or later. For NETGEAR R7000 version prior to 1.0.11.126, update to version 1.0.11.126 or later. For NETGEAR R6900P version prior to 1.3.3.140, update to version 1.3.3.140 or later. For NETGEAR R7000P version prior to 1.3.3.140, update to version 1.3.3.140 or later. For NETGEAR R8000 version prior to 1.0.4.74, update to version 1.0.4.74 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2022-01197

CVE-2021-45554

Affected Products

Netgear R6400

Netgear R6400V2

Netgear R6700V3

Netgear R6900P

Netgear R7000

Netgear R7000P

Netgear R8000

References · 4

• https://kb.netgear.com/000064119/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45554 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45554 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01197 · Security Note