CVE-2021-33514

🗓️ 21 May 2021 22:10:04Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 130 Views🌐 WEB

Certain NETGEAR devices are affected by command injection via the /sqfs/lib/libsal.so.0.0 library used by a CGI application

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2021-33514	22 May 202110:16	–	circl
CNNVD	Netgear NETGEAR 操作系统命令注入漏洞	21 May 202100:00	–	cnnvd
Check Point Advisories	NETGEAR Command Injection (CVE-2021-33514)	2 Aug 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-33514	21 May 202122:10	–	cvelist
NVD	CVE-2021-33514	21 May 202123:15	–	nvd
OpenVAS	NETGEAR Smart Cloud Switch Command Injection Vulnerability (PSV-2021-0071)	29 Jun 202100:00	–	openvas
Prion	Command injection	21 May 202123:15	–	prion
RedhatCVE	CVE-2021-33514	9 Jan 202608:52	–	redhatcve
seebug.org	NETGEAR GS110TPV3未认证命令注入漏洞(CVE-2021-33514)	15 Jul 202100:00	–	seebug

NVD

Node

netgear gc108p_firmwareRange<1.0.7.3

AND

netgear gc108pMatch-

Node

netgear gc108pp_firmwareRange<1.0.7.3

AND

netgear gc108ppMatch-

Node

netgear gs108t_firmwareRange<7.0.6.3

AND

netgear gs108tv3Match-

Node

netgear gs110tpp_firmwareRange<7.0.6.3

AND

netgear gs110tppMatchv1

Node

netgear gs110tp_firmwareRange<7.0.6.3

AND

netgear gs110tpMatchv3

Node

netgear gs110tup_firmwareRange<1.0.4.3

AND

netgear gs110tupMatchv1

Node

netgear gs710tup_firmwareRange<1.0.4.3

AND

netgear gs710tupMatchv1

Node

netgear gs716tp_firmwareRange<1.0.2.3

AND

netgear gs716tpMatch-

Node

netgear gs716tpp_firmwareRange<1.0.2.3

AND

netgear gs716tppMatch-

Node

netgear gs724tpp_firmwareRange<2.0.4.3

AND

netgear gs724tppMatchv1

Node

netgear gs724tp_firmwareRange<2.0.4.3

AND

netgear gs724tpMatchv2

Node

netgear gs728tpp_firmwareRange<6.0.6.3

AND

netgear gs728tppMatchv2

Node

netgear gs728tp_firmwareRange<6.0.6.3

AND

netgear gs728tpMatchv2

Node

netgear gs752tpp_firmwareRange<6.0.6.3

AND

netgear gs752tppMatchv1

Node

netgear gs752tp_firmwareRange<6.0.6.3

AND

netgear gs752tpMatchv2

Node

netgear ms510txm_firmwareRange<1.0.2.3

AND

netgear ms510txmMatch-

Node

netgear ms510txup_firmwareRange<1.0.2.3

AND

netgear ms510txupMatch-

Source	Link
gynvael	www.gynvael.coldwind.pl/
kb	www.kb.netgear.com/000063641/Security-Advisory-for-Pre-Authentication-Command-Injection-Vulnerability-on-Some-Smart-Switches-PSV-2021-0071

Parameter	Position	Path	Description	CWE
token	query param	/sqfs/home/web/cgi/setup.cgi	Pre-auth command injection via setup.cgi token parameter allowing arbitrary commands execution.	CWE-78

21 Nov 2024 06:08Current

9.7High risk

Vulners AI Score9.7

CVSS 3.18.8 - 9.8

CVSS 210

EPSS0.17229

CWE-78