Lucene search

[email protected]CVE-2021-45603

HistoryDec 26, 2021 - 1:15 a.m.

CVE-2021-45603

2021-12-2601:15:17

CWE-200

[email protected]

web.nvd.nist.gov

cve-2021-45603

netgear

sensitive information disclosure

upnp

password reset

security vulnerability

nvd

6.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

5.5 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.5%

JSON

Certain NETGEAR devices are affected by disclosure of sensitive information. A UPnP request reveals a device’s serial number, which can be used for a password reset. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 before 1.0.0.90, WN3000RPv3 before 1.0.2.100, LBR1020 before 2.6.5.20, LBR20 before 2.6.5.32, R6700AX before 1.0.10.110, R7800 before 1.0.2.86, R8900 before 1.0.5.38, R9000 before 1.0.5.38, RAX10 before 1.0.10.110, RAX120v1 before 1.2.3.28, RAX120v2 before 1.2.3.28, RAX70 before 1.0.10.110, RAX78 before 1.0.10.110, XR450 before 2.3.2.130, XR500 before 2.3.2.130, and XR700 before 1.0.1.46.

Affected configurations

NVD

Node

netgeard7800_firmwareRange<1.0.1.66

AND

netgeard7800Match-

Node

netgearex2700_firmwareRange<1.0.1.68

AND

netgearex2700Match-

Node

netgearwn3000rpv2_firmwareRange<1.0.0.90

AND

netgearwn3000rpv2Match-

Node

netgearwn3000rpv3_firmwareRange<1.0.2.100

AND

netgearwn3000rpv3Match-

Node

netgearlbr1020_firmwareRange<2.6.5.20

AND

netgearlbr1020Match-

Node

netgearlbr20_firmwareRange<2.6.5.32

AND

netgearlbr20Match-

Node

netgearr6700ax_firmwareRange<1.0.10.110

AND

netgearr6700axMatch-

Node

netgearr7800_firmwareRange<1.0.2.86

AND

netgearr7800Match-

Node

netgearr8900_firmwareRange<1.0.5.38

AND

netgearr8900Match-

Node

netgearr9000_firmwareRange<1.0.5.38

AND

netgearr9000Match-

Node

netgearrax10_firmwareRange<1.0.10.110

AND

netgearrax10Match-

Node

netgearrax120v1_firmwareRange<1.2.3.28

AND

netgearrax120v1Match-

Node

netgearrax120v2_firmwareRange<1.2.3.28

AND

netgearrax120v2Match-

Node

netgearrax70_firmwareRange<1.0.10.110

AND

netgearrax70Match-

Node

netgearrax78_firmwareRange<1.0.10.110

AND

netgearrax78Match-

Node

netgearxr450_firmwareRange<2.3.2.130

AND

netgearxr450Match-

Node

netgearxr500_firmwareRange<2.3.2.130

AND

netgearxr500Match-

Node

netgearxr700_firmwareRange<1.0.1.46

AND

netgearxr700Match-

CPENameOperatorVersion
netgear:d7800_firmwarenetgear d7800 firmwarelt1.0.1.66

CPE	Name	Operator	Version
netgear:d7800_firmware	netgear d7800 firmware	lt	1.0.1.66

References

immersivelabs.com/resources/blog/netgear-vulnerabilities-could-put-small-business-routers-at-risk/

kb.netgear.com/000064407/Security-Advisory-for-Post-Authentication-Command-Injection-Sensitive-Information-Disclosure-on-Multiple-Products-PSV-2021-0169-PSV-2021-0171

6.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

5.5 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

12.5%

JSON

Related for CVE-2021-45603

prion1 cvelist1 nvd1