PT-2022-1940 · NetGear · Netgear Wac120 Ac Access Point

Published 2022-01-18 · Updated 2022-03-11 · CVE-2021-46382

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netgear WAC120 AC Access Point (affected versions not specified)

Description The issue is related to unauthenticated cross-site scripting (XSS) in the Netgear WAC120 AC Access Point, which may lead to multiple attacks, including session hijacking and clipboard hijacking. This is due to the lack of protection measures for the web page structure, allowing a remote attacker to conduct cross-site scripting attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-01488

CVE-2021-46382

Affected Products

Netgear Wac120 Ac Access Point

References · 7

• 🔥 https://drive.google.com/drive/folders/1NOIoT8yE_HDoLVYhchml5E2Za3Oo6V9Y?usp=sharing · Exploit
• https://netgear.com/about/security · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01488 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-46382 · Security Note
• https://t.me/cvenotify/28108 · Telegram Post
• https://t.me/cibsecurity/38426 · Telegram Post
• https://vuldb.com/ru/?id.194231 · Note