Sign-up

ID

VAR-202103-1281


CVE

CVE-2021-29078


TITLE

plural  NETGEAR  Command injection vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2021-004583

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12. plural NETGEAR A command injection vulnerability exists in the device.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. This affects RBK852 prior to 3.2.17.12, RBK853 prior to 3.2.17.12, RBK854 prior to 3.2.17.12, RBR850 prior to 3.2.17.12, RBS850 prior to 3.2.17.12, RBK752 prior to 3.2.17.12, RBK753 prior to 3.2.17.12, RBK753S prior to 3.2.17.12, RBK754 prior to 3.2.17.12, RBR750 prior to 3.2.17.12, and RBS750 prior to 3.2.17.12

Trust: 1.71

sources: NVD: CVE-2021-29078 // JVNDB: JVNDB-2021-004583 // VULMON: CVE-2021-29078

AFFECTED PRODUCTS

vendor:netgearmodel:rbr750scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbk752scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbs850scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbr850scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbk852scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbk753scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbs750scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbk754scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbk853scope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbk753sscope:ltversion:3.2.17.12

Trust: 1.0

vendor:netgearmodel:rbk854scope:ltversion:3.2.17.12

Trust: 1.0

vendor:ネットギアmodel:rbk852scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk753sscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk853scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk854scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr850scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk752scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk753scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr750scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbs850scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk754scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-004583 // NVD: CVE-2021-29078

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-29078
value: CRITICAL

Trust: 1.0

cve@mitre.org: CVE-2021-29078
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-29078
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202103-1345
value: CRITICAL

Trust: 0.6

VULMON: CVE-2021-29078
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-29078
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2021-29078
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 6.0
version: 3.1

Trust: 2.0

OTHER: JVNDB-2021-004583
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2021-29078 // JVNDB: JVNDB-2021-004583 // CNNVD: CNNVD-202103-1345 // NVD: CVE-2021-29078 // NVD: CVE-2021-29078

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-004583 // NVD: CVE-2021-29078

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202103-1345

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202103-1345

PATCH

title:Security Advisory for Pre-Authentication Command Injection on Some WiFi Systems, PSV-2020-0511url:https://kb.netgear.com/000063009/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0511

Trust: 0.8

title:NETGEAR Repair measures for command injection vulnerabilities in multiple productsurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145161

Trust: 0.6

sources: JVNDB: JVNDB-2021-004583 // CNNVD: CNNVD-202103-1345

EXTERNAL IDS

db:NVDid:CVE-2021-29078

Trust: 2.5

db:JVNDBid:JVNDB-2021-004583

Trust: 0.8

db:CNNVDid:CNNVD-202103-1345

Trust: 0.6

db:VULMONid:CVE-2021-29078

Trust: 0.1

sources: VULMON: CVE-2021-29078 // JVNDB: JVNDB-2021-004583 // CNNVD: CNNVD-202103-1345 // NVD: CVE-2021-29078

REFERENCES

url:https://kb.netgear.com/000063009/security-advisory-for-pre-authentication-command-injection-on-some-wifi-systems-psv-2020-0511

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-29078

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/77.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2021-29078 // JVNDB: JVNDB-2021-004583 // CNNVD: CNNVD-202103-1345 // NVD: CVE-2021-29078

SOURCES

db:VULMONid:CVE-2021-29078
db:JVNDBid:JVNDB-2021-004583
db:CNNVDid:CNNVD-202103-1345
db:NVDid:CVE-2021-29078

LAST UPDATE DATE

2024-11-23T22:47:40.243000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2021-29078date:2021-03-24T00:00:00
db:JVNDBid:JVNDB-2021-004583date:2021-11-25T03:10:00
db:CNNVDid:CNNVD-202103-1345date:2021-08-16T00:00:00
db:NVDid:CVE-2021-29078date:2024-11-21T06:00:40.030

SOURCES RELEASE DATE

db:VULMONid:CVE-2021-29078date:2021-03-23T00:00:00
db:JVNDBid:JVNDB-2021-004583date:2021-11-25T00:00:00
db:CNNVDid:CNNVD-202103-1345date:2021-03-23T00:00:00
db:NVDid:CVE-2021-29078date:2021-03-23T07:15:14.077