PT-2021-6274 · NetGear · Netgear Rax43

Evan Grant + 1 · Published 2021-12-30 · Updated 2022-01-07 · CVE-2021-20166

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netgear RAX43 version 1.0.3.96

Description The issue is caused by a buffer overrun vulnerability in the URL parsing functionality of the cgi-bin endpoint. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information by potentially redirecting the control flow of the application.

Recommendations For Netgear RAX43 version 1.0.3.96, consider restricting access to the cgi-bin endpoint until a patch is available. As a temporary workaround, avoid using the vulnerable URL parsing functionality in the cgi-bin endpoint to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-01224

CVE-2021-20166

Affected Products

Netgear Rax43

References · 4

• https://osv.dev/vulnerability/CVE-2021-20166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20166 · Security Note
• https://bdu.fstec.ru/vul/2022-01224 · Security Note
• https://tenable.com/security/research/tra-2021-55 · Note