Lucene search

TenableCVE-2021-20172

HistoryDec 30, 2021 - 10:15 p.m.

CVE-2021-20172

2021-12-3022:15:09

CWE-732

tenable

web.nvd.nist.gov

netgear genie

macos

local privilege escalation

vulnerability

cve-2021-20172

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which the software is going to be installed may overwrite certain files to obtain privilege escalation to root.

Affected configurations

Nvd

Node

netgeargenie_installerMatch-macos

VendorProductVersionCPE
netgeargenie_installer-cpe:2.3:a:netgear:genie_installer:-:*:*:*:*:macos:*:*

Vendor	Product	Version	CPE
netgear	genie_installer	-	cpe:2.3:a:netgear:genie_installer:-:::::macos::

CNA Affected

[
  {
    "product": "Netgear Genie Installer for macOS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All known versions"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2021-56

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-20172