Lucene search

[email protected]CVE-2021-38537

HistoryAug 11, 2021 - 12:17 a.m.

CVE-2021-38537

2021-08-1100:17:48

CWE-79

[email protected]

web.nvd.nist.gov

netgear

devices

stored xss

cve-2021-38537

security vulnerability

nvd

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

5 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

22.6%

JSON

Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, and RAX40 before 1.0.3.62.

Affected configurations

NVD

Node

netgeard6200_firmwareRange<1.1.00.40

AND

netgeard6200Match-

Node

netgeard7000_firmwareRange<1.0.1.78

AND

netgeard7000Match-

Node

netgearr6020_firmwareRange<1.0.0.48

AND

netgearr6020Match-

Node

netgearr6080_firmwareRange<1.0.0.48

AND

netgearr6080Match-

Node

netgearr6120_firmwareRange<1.0.0.66

AND

netgearr6120Match-

Node

netgearr6260_firmwareRange<1.1.0.78

AND

netgearr6260Match-

Node

netgearr6700_firmwareRange<1.2.0.76

AND

netgearr6700Matchv2

Node

netgearr6800_firmwareRange<1.2.0.76

AND

netgearr6800Match-

Node

netgearr6900_firmwareRange<1.2.0.76

AND

netgearr6900Matchv2

Node

netgearr6850_firmwareRange<1.1.0.78

AND

netgearr6850Match-

Node

netgearr7200_firmwareRange<1.2.0.76

AND

netgearr7200Match-

Node

netgearr7350_firmwareRange<1.2.0.76

AND

netgearr7350Match-

Node

netgearr7400_firmwareRange<1.2.0.76

AND

netgearr7400Match-

Node

netgearr7450_firmwareRange<1.2.0.76

AND

netgearr7450Match-

Node

netgearac2100_firmwareRange<1.2.0.76

AND

netgearac2100Match-

Node

netgearac2400_firmwareRange<1.2.0.76

AND

netgearac2400Match-

Node

netgearac2600_firmwareRange<1.2.0.76

AND

netgearac2600Match-

Node

netgearrax40_firmwareRange<1.0.3.62

AND

netgearrax40Match-

CPENameOperatorVersion
netgear:d6200_firmwarenetgear d6200 firmwarelt1.1.00.40

CPE	Name	Operator	Version
netgear:d6200_firmware	netgear d6200 firmware	lt	1.1.00.40

References

kb.netgear.com/000063775/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0245

Social References

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

5 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

22.6%

JSON

Related for CVE-2021-38537

nvd1 prion1 cvelist1