Lucene search

[email protected]NVD:CVE-2021-27257

HistoryMar 05, 2021 - 8:15 p.m.

CVE-2021-27257

2021-03-0520:15:12

CWE-295

[email protected]

web.nvd.nist.gov

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

48.1%

JSON

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via FTP. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-12362.

Affected configurations

NVD

Node

netgearbr200Match-

AND

netgearbr200_firmwareRange<5.10.0.5

Node

netgearbr500Match-

AND

netgearbr500_firmwareRange<5.10.0.5

Node

netgeard7800Match-

AND

netgeard7800_firmwareRange<1.0.1.60

Node

netgearex6100v2Match-

AND

netgearex6100v2_firmwareRange<1.0.1.98

Node

netgearex6150v2Match-

AND

netgearex6150v2_firmwareRange<1.0.1.98

Node

netgearex6250Match-

AND

netgearex6250_firmwareRange<1.0.0.134

Node

netgearex6400Match-

AND

netgearex6400_firmwareRange<1.0.2.158

Node

netgearex6400v2Match-

AND

netgearex6400v2_firmwareRange<1.0.0.134

Node

netgearex6410_firmwareRange<1.0.0.134

AND

netgearex6410Match-

Node

netgearex6420_firmwareRange<1.0.0.134

AND

netgearex6420Match-

Node

netgearex7300_firmwareRange<1.0.2.158

AND

netgearex7300Match-

Node

netgearex7300v2_firmwareRange<1.0.0.134

AND

netgearex7300v2Match-

Node

netgearex7320_firmwareRange<1.0.0.134

AND

netgearex7320Match-

Node

netgearex7700_firmwareRange<1.0.0.216

AND

netgearex7700Match-

Node

netgearex8000_firmwareRange<1.0.1.232

AND

netgearex8000Match-

Node

netgearlbr20_firmwareRange<2.6.3.50

AND

netgearlbr20Match-

Node

netgearr7800_firmwareRange<1.0.2.80

AND

netgearr7800Match-

Node

netgearr8900_firmwareRange<1.0.5.28

AND

netgearr8900Match-

Node

netgearr9000_firmwareRange<1.0.5.28

AND

netgearr9000Match-

Node

netgearrbk12_firmwareRange<2.7.2.104

AND

netgearrbk12Match-

Node

netgearrbk13_firmwareRange<2.7.2.104

AND

netgearrbk13Match-

Node

netgearrbk14_firmwareRange<2.7.2.104

AND

netgearrbk14Match-

Node

netgearrbk15_firmwareRange<2.7.2.104

AND

netgearrbk15Match-

Node

netgearrbk20_firmwareRange<2.6.2.104

AND

netgearrbk20Match-

Node

netgearrbk23_firmwareRange<2.7.2.104

AND

netgearrbk23Match-

Node

netgearrbk40_firmwareRange<2.6.2.104

AND

netgearrbk40Match-

Node

netgearrbk43_firmwareRange<2.6.2.104

AND

netgearrbk43Match-

Node

netgearrbk43s_firmwareRange<2.6.2.104

AND

netgearrbk43sMatch-

Node

netgearrbk44_firmwareRange<2.6.2.104

AND

netgearrbk44Match-

Node

netgearrbk50_firmwareRange<2.7.2.104

AND

netgearrbk50Match-

Node

netgearrbk53_firmwareRange<2.7.2.104

AND

netgearrbk53Match-

Node

netgearrbr10_firmwareRange<2.6.2.104

AND

netgearrbr10Match-

Node

netgearrbr20_firmwareRange<2.6.2.104

AND

netgearrbr20Match-

Node

netgearrbr40_firmwareRange<2.6.2.104

AND

netgearrbr40Match-

Node

netgearrbr50_firmwareRange<2.7.2.104

AND

netgearrbr50Match-

Node

netgearrbs10_firmwareRange<2.6.2.104

AND

netgearrbs10Match-

Node

netgearrbs20_firmwareRange<2.6.2.104

AND

netgearrbs20Match-

Node

netgearrbs40_firmwareRange<2.6.2.104

AND

netgearrbs40Match-

Node

netgearrbs50_firmwareRange<2.7.2.104

AND

netgearrbs50Match-

Node

netgearrbs50y_firmwareRange<2.6.2.104

AND

netgearrbs50yMatch-

Node

netgearxr450_firmwareRange<2.3.2.114

AND

netgearxr450Match-

Node

netgearxr500_firmwareRange<2.3.2.114

AND

netgearxr500Match-

Node

netgearxr700_firmwareRange<1.0.1.38

AND

netgearxr700Match-

References

kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders

www.zerodayinitiative.com/advisories/ZDI-21-264/

3.3 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

48.1%

JSON

Related for NVD:CVE-2021-27257

cvelist1 zdi1 cve1 prion1