CVE-2021-40847

{"id": "CVE-2021-40847", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2021-09-21T18:15:07.377", "references": [{"url": "https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled by default. This daemon connects to Circle and NETGEAR to obtain version information and updates to the circled daemon and its filtering database. However, database updates from NETGEAR are unsigned and downloaded via cleartext HTTP. As such, an attacker with the ability to perform a MitM attack on the device can respond to circled update requests with a crafted, compressed database file, the extraction of which gives the attacker the ability to overwrite executable files with attacker-controlled code. This affects R6400v2 1.0.4.106, R6700 1.0.2.16, R6700v3 1.0.4.106, R6900 1.0.2.16, R6900P 1.3.2.134, R7000 1.0.11.123, R7000P 1.3.2.134, R7850 1.0.5.68, R7900 1.0.4.38, R8000 1.0.4.68, and RS400 1.5.0.68."}, {"lang": "es", "value": "El proceso de actualizaci\u00f3n del servicio de Control Parental Circle en varios routers de NETGEAR permite a atacantes remotos lograr una ejecuci\u00f3n de c\u00f3digo remota como root por medio de un ataque de tipo MitM. Mientras que los controles parentales en s\u00ed no est\u00e1n habilitados por defecto en los routers, el demonio de actualizaci\u00f3n de Circle, en forma de c\u00edrculo, est\u00e1 habilitado por defecto. Este demonio se conecta a Circle y a NETGEAR para conseguir informaci\u00f3n sobre la versi\u00f3n y las actualizaciones del demonio Circle y su base de datos de filtrado. Sin embargo, las actualizaciones de la base de datos de NETGEAR no est\u00e1n firmadas y se descargan por medio de HTTP en texto sin cifrar. De este modo, un atacante con la capacidad de llevar a cabo un ataque de tipo MitM en el dispositivo puede responder a peticiones de actualizaci\u00f3n de Circle con un archivo de base de datos dise\u00f1ado y comprimido, cuya extracci\u00f3n da al atacante la capacidad de sobrescribir archivos ejecutables con c\u00f3digo controlado por el atacante. Esto afecta al R6400v2 versi\u00f3n 1.0.4.106, al R6700 versi\u00f3n 1.0.2.16, al R6700v3 versi\u00f3n 1.0.4.106, al R6900 versi\u00f3n 1.0.2.16, al R6900P versi\u00f3n 1.3.2.134, al R7000 versi\u00f3n 1.0.11.123, al R7000P versi\u00f3n 1.3.2.134, al R7850 versi\u00f3n 1.0.5.68, al R7900 versi\u00f3n 1.0.4.38, al R8000 versi\u00f3n 1.0.4.68 y al RS400 versi\u00f3n 1.5.0.68"}], "lastModified": "2024-11-21T06:24:55.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r6400v2_firmware:1.0.4.106:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD8CD556-0F6C-4D42-A03A-354EE344BDDC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r6400v2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AFE6B3A8-0601-44EA-AD9B-3BDDE6654FDF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r6700_firmware:1.0.2.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ACE2CC9-C69A-44A9-8BAB-42C329E3C38B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r6700:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "21B27F11-4262-4CE1-8107-B365A7C152F2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r6700v3_firmware:1.0.4.106:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0B52FCA-EDE6-41A8-BACB-3DFFE94D9962"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r6700v3:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C88DA385-5FAE-49EC-80D6-78F81E7EEC16"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r6900_firmware:1.0.2.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8DB9C419-996C-47A5-BEED-AE521A32BE0B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r6900:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0794BB7C-1BCF-4F08-8EB2-9C3B150C105A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r6900p_firmware:1.3.2.134:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CAB89E0-70C5-4506-AE5E-66CE9EB4A5B4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r6900p:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C41908FF-AE64-4949-80E3-BEE061B2DA8A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r7000_firmware:1.0.11.123:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "546021FC-2BD5-4E12-AE01-BD38140CE0EC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C9F86FF6-AB32-4E51-856A-DDE790C0A9A6"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r7000p_firmware:1.3.2.134:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDD4F2A2-8691-49B2-890C-301F7E3AC308"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r7000p:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DFE55F4D-E98B-46D3-B870-041141934CD1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r7850_firmware:1.0.5.68:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A3D139C-309B-4702-AB37-905BEDBACA9E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r7850:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DAF94D73-B6D0-4334-9A41-83AA92B7C6DF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r7900_firmware:1.0.4.38:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "637AFD38-8F00-4A74-B063-3118F947DBFA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r7900:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C484840F-AF30-4B5C-821A-4DB9BE407BDB"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:r8000_firmware:1.0.4.68:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3B4845F-C368-4D7E-8091-FCA31949C4F0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:r8000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5B39F095-8FE8-43FD-A866-7B613B495984"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rs400_firmware:1.5.0.68:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3ADD139-23C6-4647-B2A4-F9C645AE7568"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rs400:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2700644E-0940-4D05-B3CA-904D91739E58"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}