CVE-2021-33514

🗓️ 21 May 2021 22:10:04Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 207 Views🌐 WEB

Certain NETGEAR devices are affected by command injection via the /sqfs/lib/libsal.so.0.0 library used by a CGI application

Reporter	Title	Published	Views	Family All 13
attackerkb	CVE-2021-33514	21 May 202123:15	–	attackerkb
Circl	CVE-2021-33514	22 May 202110:16	–	circl
CNNVD	Netgear NETGEAR operating system command injection vulnerability	21 May 202100:00	–	cnnvd
Check Point Advisories	NETGEAR Command Injection (CVE-2021-33514)	2 Aug 202100:00	–	checkpoint_advisories
Cvelist	CVE-2021-33514	21 May 202122:10	–	cvelist
NVD	CVE-2021-33514	21 May 202123:15	–	nvd
OpenVAS	NETGEAR Smart Cloud Switch Command Injection Vulnerability (PSV-2021-0071)	29 Jun 202100:00	–	openvas
osv_cve	CVE-2021-33514	21 May 202123:15	–	osv_cve
Prion	Command injection	21 May 202123:15	–	prion
Positive Technologies	PT-2021-20172	21 May 202100:00	–	ptsecurity

NVD

Node

AND

netgear gc108p_firmwareRange<1.0.7.3

netgear gc108pMatch-

Node

AND

netgear gc108pp_firmwareRange<1.0.7.3

netgear gc108ppMatch-

Node

AND

netgear gs108t_firmwareRange<7.0.6.3

netgear gs108tv3Match-

Node

AND

netgear gs110tpp_firmwareRange<7.0.6.3

netgear gs110tppMatchv1

Node

AND

netgear gs110tp_firmwareRange<7.0.6.3

netgear gs110tpMatchv3

Node

AND

netgear gs110tup_firmwareRange<1.0.4.3

netgear gs110tupMatchv1

Node

AND

netgear gs710tup_firmwareRange<1.0.4.3

netgear gs710tupMatchv1

Node

AND

netgear gs716tp_firmwareRange<1.0.2.3

netgear gs716tpMatch-

Node

AND

netgear gs716tpp_firmwareRange<1.0.2.3

netgear gs716tppMatch-

Node

AND

netgear gs724tpp_firmwareRange<2.0.4.3

netgear gs724tppMatchv1

Node

AND

netgear gs724tp_firmwareRange<2.0.4.3

netgear gs724tpMatchv2

Node

AND

netgear gs728tpp_firmwareRange<6.0.6.3

netgear gs728tppMatchv2

Node

AND

netgear gs728tp_firmwareRange<6.0.6.3

netgear gs728tpMatchv2

Node

AND

netgear gs752tpp_firmwareRange<6.0.6.3

netgear gs752tppMatchv1

Node

AND

netgear gs752tp_firmwareRange<6.0.6.3

netgear gs752tpMatchv2

Node

AND

netgear ms510txm_firmwareRange<1.0.2.3

netgear ms510txmMatch-

Node

AND

netgear ms510txup_firmwareRange<1.0.2.3

netgear ms510txupMatch-

Source	Link
gynvael	www.gynvael.coldwind.pl/
kb	www.kb.netgear.com/000063641/Security-Advisory-for-Pre-Authentication-Command-Injection-Vulnerability-on-Some-Smart-Switches-PSV-2021-0071

Parameter	Position	Path	Description	CWE
token	query param	/cgi/setup.cgi	Command injection via the 'token' query parameter. The application fails to properly sanitize the input, allowing an attacker to break out of a single quote enclosure and execute arbitrary OS commands. The payload can be further delivered via the User-Agent header or the request body.	CWE-78

17 Jun 2026 03:54Current

8.2High risk

Vulners AI Score8.2

CVSS 3.18.8 - 9.8

CVSS 210

EPSS0.07863

CWE-78