CVE-2021-45666

Certain NETGEAR devices are affected by stored XSS. This affects CBR40 before 2.5.0.10, EAX80 before 1.0.1.64, EX3700 before 1.0.0.90, EX3800 before 1.0.0.90, EX6120 before 1.0.0.64, EX6130 before 1.0.0.44, EX7500 before 1.0.0.72, RBW30 before 2.6.1.4, RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, RBS850 before 3.2.16.6, and RBS40V before 2.6.1.4.

CVSS v3 6.5 MEDIUM
CVSS v2.0 3.5 LOW

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 5.3

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://kb.netgear.com/000064121/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-WiFi-Systems-PSV-2020-0254	Patch Vendor Advisory
https://kb.netgear.com/000064121/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-WiFi-Systems-PSV-2020-0254	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:eax80_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:eax80:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:netgear:ex3700_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:ex3700:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:netgear:ex3800_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:ex3800:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:netgear:ex6120_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:ex6120:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:netgear:ex6130_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:ex6130:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:netgear:ex7500_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:ex7500:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:netgear:rbw30_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbw30:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

cpe:2.3:o:netgear:rbk752_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbk752:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:netgear:rbr750_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbr750:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND

cpe:2.3:o:netgear:rbs750_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbs750:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND

cpe:2.3:o:netgear:rbk852_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbk852:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND

cpe:2.3:o:netgear:rbr850_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbr850:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND

cpe:2.3:o:netgear:rbs850_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbs850:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND

cpe:2.3:o:netgear:rbs40v_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rbs40v:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND

cpe:2.3:o:netgear:cbr40_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:netgear:cbr40:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:32

Type	Values Removed	Values Added
CVSS	v2 : ~~3.5~~ v3 : ~~4.8~~	v2 : 3.5 v3 : 6.5
References	~~() https://kb.netgear.com/000064121/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-WiFi-Systems-PSV-2020-0254 - Patch, Vendor Advisory~~	() https://kb.netgear.com/000064121/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-WiFi-Systems-PSV-2020-0254 - Patch, Vendor Advisory

05 Jan 2022, 21:19

Type	Values Removed	Values Added
References	~~(MISC) https://kb.netgear.com/000064121/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-WiFi-Systems-PSV-2020-0254 -~~	(MISC) https://kb.netgear.com/000064121/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Extenders-and-WiFi-Systems-PSV-2020-0254 - Patch, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 3.5 v3 : 4.8
CPE		cpe:2.3:h:netgear:ex3800:-:::::::* cpe:2.3:o:netgear:rbr850_firmware:::::::: cpe:2.3:h:netgear:eax80:-:::::::* cpe:2.3:o:netgear:ex6120_firmware:::::::: cpe:2.3:h:netgear:ex6120:-:::::::* cpe:2.3:o:netgear:rbk852_firmware:::::::: cpe:2.3:h:netgear:rbs40v:-:::::::* cpe:2.3:o:netgear:ex7500_firmware:::::::: cpe:2.3:h:netgear:ex7500:-:::::::* cpe:2.3:o:netgear:cbr40_firmware:::::::: cpe:2.3:o:netgear:rbr750_firmware:::::::: cpe:2.3:h:netgear:cbr40:-:::::::* cpe:2.3:o:netgear:ex3800_firmware:::::::: cpe:2.3:o:netgear:rbk752_firmware:::::::: cpe:2.3:h:netgear:rbr850:-:::::::* cpe:2.3:h:netgear:ex6130:-:::::::* cpe:2.3:o:netgear:rbs850_firmware:::::::: cpe:2.3:o:netgear:ex6130_firmware:::::::: cpe:2.3:h:netgear:rbw30:-:::::::* cpe:2.3:o:netgear:rbs750_firmware:::::::: cpe:2.3:o:netgear:ex3700_firmware:::::::: cpe:2.3:h:netgear:rbs850:-:::::::* cpe:2.3:h:netgear:ex3700:-:::::::* cpe:2.3:h:netgear:rbk852:-:::::::* cpe:2.3:h:netgear:rbs750:-:::::::* cpe:2.3:o:netgear:rbw30_firmware:::::::: cpe:2.3:h:netgear:rbr750:-:::::::* cpe:2.3:h:netgear:rbk752:-:::::::* cpe:2.3:o:netgear:rbs40v_firmware:::::::: cpe:2.3:o:netgear:eax80_firmware::::::::
CWE		CWE-79

26 Dec 2021, 01:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-12-26 01:15

Updated : 2024-11-21 06:32

NVD link : CVE-2021-45666

Mitre link : CVE-2021-45666

CVE.ORG link : CVE-2021-45666

JSON object : View

Products Affected

netgear

rbr850
rbs40v_firmware
cbr40
ex3700_firmware
ex6130_firmware
ex6120_firmware
rbk752_firmware
rbw30
rbk752
rbr850_firmware
rbk852
ex6120
eax80
rbs750
ex7500_firmware
eax80_firmware
rbw30_firmware
ex7500
ex3800
rbs750_firmware
ex6130
rbr750
ex3700
rbr750_firmware
rbs850
rbs40v
ex3800_firmware
cbr40_firmware
rbk852_firmware
rbs850_firmware

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.5 /10