CVE-2021-45602

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-45602
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 before 1.0.0.90, WN3000RPv3 before 1.0.2.100, LBR1020 before 2.6.5.20, LBR20 before 2.6.5.32, R6700AX before 1.0.10.110, R7800 before 1.0.2.86, R8900 before 1.0.5.38, R9000 before 1.0.5.38, RAX10 before 1.0.10.110, RAX120v1 before 1.2.3.28, RAX120v2 before 1.2.3.28, RAX70 before 1.0.10.110, RAX78 before 1.0.10.110, XR450 before 2.3.2.130, XR500 before 2.3.2.130, and XR700 before 1.0.1.46.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/ Third Party Advisory
https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171 Patch Vendor Advisory
https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/ Third Party Advisory
https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:netgear:d7800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:d7800:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netgear:ex2700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ex2700:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netgear:wn3000rpv2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wn3000rpv2:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netgear:wn3000rpv3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wn3000rpv3:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netgear:r6700ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r6700ax:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r7800:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netgear:r8900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r8900:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:netgear:rax10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax10:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:netgear:rax120v1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax120v1:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:netgear:rax120v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax120v2:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:netgear:rax70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax70:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:netgear:rax78_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax78:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:netgear:xr450_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr450:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr500:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:netgear:xr700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr700:-:*:*:*:*:*:*:*
History

21 Nov 2024, 06:32

Type Values Removed Values Added
References () https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/ - Third Party Advisory () https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/ - Third Party Advisory
References () https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171 - Patch, Vendor Advisory () https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171 - Patch, Vendor Advisory
CVSS v2 : 4.6
v3 : 7.8 		v2 : 4.6
v3 : 6.1

12 Jul 2022, 17:42

Type Values Removed Values Added
CWE CWE-77 CWE-78

06 Jan 2022, 19:08

Type Values Removed Values Added
CPE cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wn3000rpv2:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax120v2:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr700:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax78:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:wn3000rpv3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r8900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax78_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:wn3000rpv2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax70:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:wn3000rpv3:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax120v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr500:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:d7800_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax10_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:ex2700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:r6700ax_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax120v1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xr700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:d7800:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr450:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xr450_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax70_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r6700ax:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r8900:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax120v1:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ex2700:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax10:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:r7800:-:*:*:*:*:*:*:*
References (MISC) https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/ - (MISC) https://immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/ - Third Party Advisory
References (MISC) https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171 - (MISC) https://kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171 - Patch, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : 4.6
v3 : 7.8
CWE CWE-77

26 Dec 2021, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-26 01:15

Updated : 2024-11-21 06:32

NVD link : CVE-2021-45602

Mitre link : CVE-2021-45602

CVE.ORG link : CVE-2021-45602

JSON object : View

Products Affected

netgear

  • d7800_firmware
  • xr500_firmware
  • rax78_firmware
  • xr500
  • wn3000rpv3_firmware
  • ex2700
  • rax10
  • wn3000rpv3
  • r8900
  • r9000
  • xr450_firmware
  • r7800
  • rax78
  • rax70_firmware
  • r7800_firmware
  • rax120v2_firmware
  • r9000_firmware
  • xr700
  • lbr20
  • rax10_firmware
  • r6700ax_firmware
  • lbr1020
  • ex2700_firmware
  • rax120v2
  • lbr20_firmware
  • xr700_firmware
  • wn3000rpv2_firmware
  • rax120v1_firmware
  • rax120v1
  • r6700ax
  • wn3000rpv2
  • lbr1020_firmware
  • d7800
  • rax70
  • r8900_firmware
  • xr450
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')