Lucene search

ZdiCVE-2021-27256

HistoryMar 05, 2021 - 8:15 p.m.

CVE-2021-27256

2021-03-0520:15:12

CWE-78

zdi

web.nvd.nist.gov

cve-2021-27256

netgear r7800

firmware

arbitrary code execution

vulnerability

authentication bypass

system call

zdi-can-12355

nvd

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.3%

JSON

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the rc_service parameter provided to apply_save.cgi. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12355.

Affected configurations

Nvd

Vulners

Node

netgearbr200Match-

AND

netgearbr200_firmwareRange<5.10.0.5

Node

netgearbr500Match-

AND

netgearbr500_firmwareRange<5.10.0.5

Node

netgeard7800Match-

AND

netgeard7800_firmwareRange<1.0.1.60

Node

netgearex6100v2Match-

AND

netgearex6100v2_firmwareRange<1.0.1.98

Node

netgearex6150v2Match-

AND

netgearex6150v2_firmwareRange<1.0.1.98

Node

netgearex6250Match-

AND

netgearex6250_firmwareRange<1.0.0.134

Node

netgearex6400Match-

AND

netgearex6400_firmwareRange<1.0.2.158

Node

netgearex6400v2Match-

AND

netgearex6400v2_firmwareRange<1.0.0.134

Node

netgearex6410_firmwareRange<1.0.0.134

AND

netgearex6410Match-

Node

netgearex6420_firmwareRange<1.0.0.134

AND

netgearex6420Match-

Node

netgearex7300_firmwareRange<1.0.2.158

AND

netgearex7300Match-

Node

netgearex7300v2_firmwareRange<1.0.0.134

AND

netgearex7300v2Match-

Node

netgearex7320_firmwareRange<1.0.0.134

AND

netgearex7320Match-

Node

netgearex7700_firmwareRange<1.0.0.216

AND

netgearex7700Match-

Node

netgearex8000_firmwareRange<1.0.1.232

AND

netgearex8000Match-

Node

netgearlbr20_firmwareRange<2.6.3.50

AND

netgearlbr20Match-

Node

netgearr7800_firmwareRange<1.0.2.80

AND

netgearr7800Match-

Node

netgearr8900_firmwareRange<1.0.5.28

AND

netgearr8900Match-

Node

netgearr9000_firmwareRange<1.0.5.28

AND

netgearr9000Match-

Node

netgearrbk12_firmwareRange<2.7.2.104

AND

netgearrbk12Match-

Node

netgearrbk13_firmwareRange<2.7.2.104

AND

netgearrbk13Match-

Node

netgearrbk14_firmwareRange<2.7.2.104

AND

netgearrbk14Match-

Node

netgearrbk15_firmwareRange<2.7.2.104

AND

netgearrbk15Match-

Node

netgearrbk20_firmwareRange<2.6.2.104

AND

netgearrbk20Match-

Node

netgearrbk23_firmwareRange<2.7.2.104

AND

netgearrbk23Match-

Node

netgearrbk40_firmwareRange<2.6.2.104

AND

netgearrbk40Match-

Node

netgearrbk43_firmwareRange<2.6.2.104

AND

netgearrbk43Match-

Node

netgearrbk43s_firmwareRange<2.6.2.104

AND

netgearrbk43sMatch-

Node

netgearrbk44_firmwareRange<2.6.2.104

AND

netgearrbk44Match-

Node

netgearrbk50_firmwareRange<2.7.2.104

AND

netgearrbk50Match-

Node

netgearrbk53_firmwareRange<2.7.2.104

AND

netgearrbk53Match-

Node

netgearrbr10_firmwareRange<2.6.2.104

AND

netgearrbr10Match-

Node

netgearrbr20_firmwareRange<2.6.2.104

AND

netgearrbr20Match-

Node

netgearrbr40_firmwareRange<2.6.2.104

AND

netgearrbr40Match-

Node

netgearrbr50_firmwareRange<2.7.2.104

AND

netgearrbr50Match-

Node

netgearrbs10_firmwareRange<2.6.2.104

AND

netgearrbs10Match-

Node

netgearrbs20_firmwareRange<2.6.2.104

AND

netgearrbs20Match-

Node

netgearrbs40_firmwareRange<2.6.2.104

AND

netgearrbs40Match-

Node

netgearrbs50_firmwareRange<2.7.2.104

AND

netgearrbs50Match-

Node

netgearrbs50y_firmwareRange<2.6.2.104

AND

netgearrbs50yMatch-

Node

netgearxr450_firmwareRange<2.3.2.114

AND

netgearxr450Match-

Node

netgearxr500_firmwareRange<2.3.2.114

AND

netgearxr500Match-

Node

netgearxr700_firmwareRange<1.0.1.38

AND

netgearxr700Match-

VendorProductVersionCPE
netgearbr200-cpe:2.3:h:netgear:br200:-:*:*:*:*:*:*:*
netgearbr200_firmware*cpe:2.3:o:netgear:br200_firmware:*:*:*:*:*:*:*:*
netgearbr500-cpe:2.3:h:netgear:br500:-:*:*:*:*:*:*:*
netgearbr500_firmware*cpe:2.3:o:netgear:br500_firmware:*:*:*:*:*:*:*:*
netgeard7800-cpe:2.3:h:netgear:d7800:-:*:*:*:*:*:*:*
netgeard7800_firmware*cpe:2.3:o:netgear:d7800_firmware:*:*:*:*:*:*:*:*
netgearex6100v2-cpe:2.3:h:netgear:ex6100v2:-:*:*:*:*:*:*:*
netgearex6100v2_firmware*cpe:2.3:o:netgear:ex6100v2_firmware:*:*:*:*:*:*:*:*
netgearex6150v2-cpe:2.3:h:netgear:ex6150v2:-:*:*:*:*:*:*:*
netgearex6150v2_firmware*cpe:2.3:o:netgear:ex6150v2_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netgear	br200	-	cpe:2.3:h:netgear:br200:-:::::::*
netgear	br200_firmware	*	cpe:2.3:o:netgear:br200_firmware::::::::
netgear	br500	-	cpe:2.3:h:netgear:br500:-:::::::*
netgear	br500_firmware	*	cpe:2.3:o:netgear:br500_firmware::::::::
netgear	d7800	-	cpe:2.3:h:netgear:d7800:-:::::::*
netgear	d7800_firmware	*	cpe:2.3:o:netgear:d7800_firmware::::::::
netgear	ex6100v2	-	cpe:2.3:h:netgear:ex6100v2:-:::::::*
netgear	ex6100v2_firmware	*	cpe:2.3:o:netgear:ex6100v2_firmware::::::::
netgear	ex6150v2	-	cpe:2.3:h:netgear:ex6150v2:-:::::::*
netgear	ex6150v2_firmware	*	cpe:2.3:o:netgear:ex6150v2_firmware::::::::

Rows per page:

1-10 of 861

CNA Affected

[
  {
    "product": "R7800",
    "vendor": "NETGEAR",
    "versions": [
      {
        "status": "affected",
        "version": "firmware version 1.0.2.76"
      }
    ]
  }
]

References

kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders

www.zerodayinitiative.com/advisories/ZDI-21-262/

Social References

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.3%

JSON

Related for CVE-2021-27256