CVE-2021-40866

🗓️ 13 Sep 2021 07:16:58Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

NETGEAR smart switches affected by unauthenticated remote admin password chang

Reporter	Title	Published	Views	Family All 10
CNNVD	NETGEAR 安全漏洞	13 Sep 202100:00	–	cnnvd
CNVD	Multiple NETGEAR Smart Switches Vulnerable to Input Validation Errors	14 Sep 202100:00	–	cnvd
Cvelist	CVE-2021-40866	13 Sep 202107:16	–	cvelist
EUVD	EUVD-2021-28021	3 Oct 202520:07	–	euvd
NCSC	Vulnerabilities fixed in Netgear SmartSwitches	17 Sep 202100:00	–	ncsc
NVD	CVE-2021-40866	13 Sep 202108:15	–	nvd
OSV	CVE-2021-40866	13 Sep 202108:15	–	osv
Prion	Authentication flaw	13 Sep 202108:15	–	prion
Positive Technologies	PT-2021-22993 · NetGear · Netgear Gc108P +15	13 Sep 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-40866	6 Feb 202504:09	–	redhatcve

NVD

Node

netgear gc108p_firmwareRange<1.0.8.2

AND

netgear gc108pMatch-

Node

netgear gc108pp_firmwareRange<1.0.8.2

AND

netgear gc108ppMatch-

Node

netgear gs108t_firmwareRange<7.0.7.2

AND

netgear gs108tv3Match-

Node

netgear gs110tpp_firmwareRange<7.0.7.2

AND

netgear gs110tppMatch-

Node

netgear gs110tp_firmwareRange<7.0.7.2

AND

netgear gs110tpMatchv3

Node

netgear gs110tup_firmwareRange<1.0.5.3

AND

netgear gs110tupMatch-

Node

netgear gs308t_firmwareRange<1.0.3.2

AND

netgear gs308tMatch-

Node

netgear gs310tp_firmwareRange<1.0.3.2

AND

netgear gs310tpMatch-

Node

netgear gs710tup_firmwareRange<1.0.5.3

AND

netgear gs710tupMatch-

Node

netgear gs716tp_firmwareRange<1.0.4.2

AND

netgear gs716tpMatch-

Node

netgear gs716tpp_firmwareRange<1.0.4.2

AND

netgear gs716tppMatch-

Node

netgear gs724tpp_firmwareRange<2.0.6.3

AND

netgear gs724tppMatch-

Node

netgear gs724tp_firmwareRange<2.0.6.3

AND

netgear gs724tpMatchv2

Node

netgear gs728tpp_firmwareRange<6.0.8.2

AND

netgear gs728tppMatchv2

Node

netgear gs728tp_firmwareRange<6.0.8.2

AND

netgear gs728tpMatchv2

Node

netgear gs750e_firmwareRange<1.0.1.10

AND

netgear gs750eMatch-

Node

netgear gs752tpp_firmwareRange<6.0.8.2

AND

netgear gs752tppMatch-

Node

netgear gs752tp_firmwareRange<6.0.8.2

AND

netgear gs752tpMatchv2

Node

netgear ms510txm_firmwareRange<1.0.4.2

AND

netgear ms510txmMatch-

Node

netgear ms510txup_firmwareRange<1.0.4.2

AND

netgear ms510txupMatch-

Source	Link
gynvael	www.gynvael.coldwind.pl/
kb	www.kb.netgear.com/000063978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145

Parameter	Position	Path	Description	CWE
authentication TLV missing from NSDP packet	path	sqfs/bin/sccd	Unauthenticated attacker can leverage NSDP packets lacking authentication to trigger remote admin password change via the sccd daemon.	CWE-287
NSDP packet without authentication TLV	path	sqfs/bin/sccd	Unauthenticated attacker can leverage NSDP packets lacking authentication to trigger remote admin password change via the sccd daemon.	CWE-287

21 Nov 2024 06:24Current

8.9High risk

Vulners AI Score8.9

CVSS 25.4

CVSS 3.18.8 - 9.8

EPSS0.01428

cve-2021-40866 netgear smart switches remote admin password change unauthenticated attacker