Details of VAR-202103-0948

ID

VAR-202103-0948

CVE

CVE-2021-27257

TITLE

NETGEAR R7800 Firmware validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-004503

DESCRIPTION

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via FTP. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-12362. NETGEAR R7800 There is a certificate validation vulnerability in the firmware. Zero Day Initiative To this vulnerability ZDI-CAN-12362 Was numbered.Information may be tampered with. Netgear NETGEAR R7800 is a wireless router from Netgear

Trust: 2.88

sources: NVD: CVE-2021-27257 // JVNDB: JVNDB-2021-004503 // ZDI: ZDI-21-264 // CNVD: CNVD-2021-14775 // VULMON: CVE-2021-27257

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-14775

AFFECTED PRODUCTS

vendor:	netgear	model:	r7800	scope:	-	version:	-	Trust: 1.3
vendor:	netgear	model:	rbk53	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	r9000	scope:	lt	version:	1.0.5.28	Trust: 1.0
vendor:	netgear	model:	ex6250	scope:	lt	version:	1.0.0.134	Trust: 1.0
vendor:	netgear	model:	r7800	scope:	lt	version:	1.0.2.80	Trust: 1.0
vendor:	netgear	model:	rbr20	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	r8900	scope:	lt	version:	1.0.5.28	Trust: 1.0
vendor:	netgear	model:	rbk20	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	rbk40	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	ex6400	scope:	lt	version:	1.0.2.158	Trust: 1.0
vendor:	netgear	model:	rbs50	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	rbs10	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	rbk12	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	rbs40	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	d7800	scope:	lt	version:	1.0.1.60	Trust: 1.0
vendor:	netgear	model:	ex6420	scope:	lt	version:	1.0.0.134	Trust: 1.0
vendor:	netgear	model:	ex7300	scope:	lt	version:	1.0.2.158	Trust: 1.0
vendor:	netgear	model:	ex6400v2	scope:	lt	version:	1.0.0.134	Trust: 1.0
vendor:	netgear	model:	ex7320	scope:	lt	version:	1.0.0.134	Trust: 1.0
vendor:	netgear	model:	rbr50	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	rbk13	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	rbk23	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	br200	scope:	lt	version:	5.10.0.5	Trust: 1.0
vendor:	netgear	model:	rbk44	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	xr500	scope:	lt	version:	2.3.2.114	Trust: 1.0
vendor:	netgear	model:	lbr20	scope:	lt	version:	2.6.3.50	Trust: 1.0
vendor:	netgear	model:	ex6150v2	scope:	lt	version:	1.0.1.98	Trust: 1.0
vendor:	netgear	model:	rbs20	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	ex6410	scope:	lt	version:	1.0.0.134	Trust: 1.0
vendor:	netgear	model:	rbs50y	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	rbk50	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	xr450	scope:	lt	version:	2.3.2.114	Trust: 1.0
vendor:	netgear	model:	br500	scope:	lt	version:	5.10.0.5	Trust: 1.0
vendor:	netgear	model:	rbk14	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	netgear	model:	ex7300v2	scope:	lt	version:	1.0.0.134	Trust: 1.0
vendor:	netgear	model:	xr700	scope:	lt	version:	1.0.1.38	Trust: 1.0
vendor:	netgear	model:	rbr40	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	ex6100v2	scope:	lt	version:	1.0.1.98	Trust: 1.0
vendor:	netgear	model:	rbk43	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	ex7700	scope:	lt	version:	1.0.0.216	Trust: 1.0
vendor:	netgear	model:	rbr10	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	rbk43s	scope:	lt	version:	2.6.2.104	Trust: 1.0
vendor:	netgear	model:	ex8000	scope:	lt	version:	1.0.1.232	Trust: 1.0
vendor:	netgear	model:	rbk15	scope:	lt	version:	2.7.2.104	Trust: 1.0
vendor:	ネットギア	model:	ex6150v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	br500	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6250	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6410	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6400v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6400	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6420	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	br200	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6100v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	d7800	scope:	-	version:	-	Trust: 0.8

sources: ZDI: ZDI-21-264 // CNVD: CNVD-2021-14775 // JVNDB: JVNDB-2021-004503 // NVD: CVE-2021-27257

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-27257
value:	MEDIUM
Trust: 1.0
zdi-disclosures@trendmicro.com:	CVE-2021-27257
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-27257
value:	MEDIUM
Trust: 0.8
ZDI:	CVE-2021-27257
value:	MEDIUM
Trust: 0.7
CNVD:	CNVD-2021-14775
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202102-1752
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2021-27257
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2021-27257
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2021-14775
severity:	MEDIUM
baseScore:	6.1
vectorString:	AV:A/AC:L/AU:N/C:N/I:C/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	COMPLETE
availabilityImpact:	NONE
exploitabilityScore:	6.5
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2021-27257
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2021-27257
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
ZDI:	CVE-2021-27257
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-21-264 // CNVD: CNVD-2021-14775 // VULMON: CVE-2021-27257 // JVNDB: JVNDB-2021-004503 // CNNVD: CNNVD-202102-1752 // NVD: CVE-2021-27257 // NVD: CVE-2021-27257

PROBLEMTYPE DATA

problemtype:	CWE-295	Trust: 1.0
problemtype:	Bad certificate verification (CWE-295) [ Other ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-004503 // NVD: CVE-2021-27257

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202102-1752

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202102-1752

PATCH

title:	Security Advisory for Multiple Vulnerabilities on Some Routers, Satellites, and Extenders	url:	https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders	Trust: 1.5
title:	Patch for NETGEAR remote code execution vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/251011	Trust: 0.6
title:	NETGEAR Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=142983	Trust: 0.6

sources: ZDI: ZDI-21-264 // CNVD: CNVD-2021-14775 // JVNDB: JVNDB-2021-004503 // CNNVD: CNNVD-202102-1752

EXTERNAL IDS

db:	NVD	id:	CVE-2021-27257	Trust: 3.8
db:	ZDI	id:	ZDI-21-264	Trust: 3.8
db:	JVNDB	id:	JVNDB-2021-004503	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-12362	Trust: 0.7
db:	CNVD	id:	CNVD-2021-14775	Trust: 0.6
db:	CNNVD	id:	CNNVD-202102-1752	Trust: 0.6
db:	VULMON	id:	CVE-2021-27257	Trust: 0.1

sources: ZDI: ZDI-21-264 // CNVD: CNVD-2021-14775 // VULMON: CVE-2021-27257 // JVNDB: JVNDB-2021-004503 // CNNVD: CNNVD-202102-1752 // NVD: CVE-2021-27257

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-21-264/	Trust: 3.8
url:	https://kb.netgear.com/000062883/security-advisory-for-multiple-vulnerabilities-on-some-routers-satellites-and-extenders	Trust: 2.4
url:	https://nvd.nist.gov/vuln/detail/cve-2021-27257	Trust: 1.4
url:	https://cwe.mitre.org/data/definitions/295.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: ZDI: ZDI-21-264 // CNVD: CNVD-2021-14775 // VULMON: CVE-2021-27257 // JVNDB: JVNDB-2021-004503 // CNNVD: CNNVD-202102-1752 // NVD: CVE-2021-27257

CREDITS

Team FLASHBACK: Pedro Ribeiro (@pedrib1337 | pedrib@gmail.com) + Radek Domanski (@RabbitPro)

Trust: 0.7

sources: ZDI: ZDI-21-264

SOURCES

db:	ZDI	id:	ZDI-21-264
db:	CNVD	id:	CNVD-2021-14775
db:	VULMON	id:	CVE-2021-27257
db:	JVNDB	id:	JVNDB-2021-004503
db:	CNNVD	id:	CNNVD-202102-1752
db:	NVD	id:	CVE-2021-27257

LAST UPDATE DATE

2024-11-23T22:54:53.310000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-21-264	date:	2021-06-29T00:00:00
db:	CNVD	id:	CNVD-2021-14775	date:	2021-03-07T00:00:00
db:	VULMON	id:	CVE-2021-27257	date:	2021-03-17T00:00:00
db:	JVNDB	id:	JVNDB-2021-004503	date:	2021-11-24T03:20:00
db:	CNNVD	id:	CNNVD-202102-1752	date:	2021-03-19T00:00:00
db:	NVD	id:	CVE-2021-27257	date:	2024-11-21T05:57:42.320

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-21-264	date:	2021-02-26T00:00:00
db:	CNVD	id:	CNVD-2021-14775	date:	2021-03-06T00:00:00
db:	VULMON	id:	CVE-2021-27257	date:	2021-03-05T00:00:00
db:	JVNDB	id:	JVNDB-2021-004503	date:	2021-11-24T00:00:00
db:	CNNVD	id:	CNNVD-202102-1752	date:	2021-02-26T00:00:00
db:	NVD	id:	CVE-2021-27257	date:	2021-03-05T20:15:12.660