ID

VAR-202108-1581


CVE

CVE-2021-38536


TITLE

plural  NETGEAR  Cross-site scripting vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2021-010440

DESCRIPTION

Certain NETGEAR devices are affected by stored XSS. This affects D6200 before 1.1.00.40, D7000 before 1.0.1.78, R6020 before 1.0.0.48, R6080 before 1.0.0.48, R6120 before 1.0.0.66, R6260 before 1.1.0.78, R6700v2 before 1.2.0.76, R6800 before 1.2.0.76, R6900v2 before 1.2.0.76, R6850 before 1.1.0.78, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, AC2600 before 1.2.0.76, RAX35 before 1.0.3.62, and RAX40 before 1.0.3.62. plural NETGEAR A cross-site scripting vulnerability exists in the device.Information may be obtained and information may be tampered with. This affects D6200 prior to 1.1.00.40, D7000 prior to 1.0.1.78, R6020 prior to 1.0.0.48, R6080 prior to 1.0.0.48, R6120 prior to 1.0.0.66, R6260 prior to 1.1.0.78, R6700v2 prior to 1.2.0.76, R6800 prior to 1.2.0.76, R6900v2 prior to 1.2.0.76, R6850 prior to 1.1.0.78, R7200 prior to 1.2.0.76, R7350 prior to 1.2.0.76, R7400 prior to 1.2.0.76, R7450 prior to 1.2.0.76, AC2100 prior to 1.2.0.76, AC2400 prior to 1.2.0.76, AC2600 prior to 1.2.0.76, RAX35 prior to 1.0.3.62, and RAX40 prior to 1.0.3.62

Trust: 1.71

sources: NVD: CVE-2021-38536 // JVNDB: JVNDB-2021-010440 // VULMON: CVE-2021-38536

AFFECTED PRODUCTS

vendor:netgearmodel:r7200scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:r6120scope:ltversion:1.0.0.66

Trust: 1.0

vendor:netgearmodel:ac2100scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:r6900scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:d7000scope:ltversion:1.0.1.78

Trust: 1.0

vendor:netgearmodel:rax40scope:ltversion:1.0.3.62

Trust: 1.0

vendor:netgearmodel:r7400scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:r7350scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:r6020scope:ltversion:1.0.0.48

Trust: 1.0

vendor:netgearmodel:r6260scope:ltversion:1.1.0.78

Trust: 1.0

vendor:netgearmodel:r6800scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:r6850scope:ltversion:1.1.0.78

Trust: 1.0

vendor:netgearmodel:r7450scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:d6200scope:ltversion:1.1.00.40

Trust: 1.0

vendor:netgearmodel:ac2600scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:r6700scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:ac2400scope:ltversion:1.2.0.76

Trust: 1.0

vendor:netgearmodel:rax35scope:ltversion:1.0.3.62

Trust: 1.0

vendor:netgearmodel:r6080scope:ltversion:1.0.0.48

Trust: 1.0

vendor:ネットギアmodel:d7000scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6020scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6850scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6700scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6080scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6800scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6120scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6900scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6260scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:d6200scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-010440 // NVD: CVE-2021-38536

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-38536
value: MEDIUM

Trust: 1.0

cve@mitre.org: CVE-2021-38536
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-38536
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202108-943
value: MEDIUM

Trust: 0.6

VULMON: CVE-2021-38536
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2021-38536
severity: LOW
baseScore: 3.5
vectorString: AV:N/AC:M/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2021-38536
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 1.7
impactScore: 2.7
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2021-38536
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 1.2
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: CVE-2021-38536
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2021-38536 // JVNDB: JVNDB-2021-010440 // CNNVD: CNNVD-202108-943 // NVD: CVE-2021-38536 // NVD: CVE-2021-38536

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-010440 // NVD: CVE-2021-38536

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-943

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202108-943

PATCH

title:Security Advisory for Stored Cross Site Scripting on Some Routers and Gateways, PSV-2019-0193url:https://kb.netgear.com/000063774/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-Gateways-PSV-2019-0193

Trust: 0.8

title:Netgear NETGEAR Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=159337

Trust: 0.6

sources: JVNDB: JVNDB-2021-010440 // CNNVD: CNNVD-202108-943

EXTERNAL IDS

db:NVDid:CVE-2021-38536

Trust: 3.3

db:JVNDBid:JVNDB-2021-010440

Trust: 0.8

db:CNNVDid:CNNVD-202108-943

Trust: 0.6

db:VULMONid:CVE-2021-38536

Trust: 0.1

sources: VULMON: CVE-2021-38536 // JVNDB: JVNDB-2021-010440 // CNNVD: CNNVD-202108-943 // NVD: CVE-2021-38536

REFERENCES

url:https://kb.netgear.com/000063774/security-advisory-for-stored-cross-site-scripting-on-some-routers-and-gateways-psv-2019-0193

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-38536

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/79.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2021-38536 // JVNDB: JVNDB-2021-010440 // CNNVD: CNNVD-202108-943 // NVD: CVE-2021-38536

SOURCES

db:VULMONid:CVE-2021-38536
db:JVNDBid:JVNDB-2021-010440
db:CNNVDid:CNNVD-202108-943
db:NVDid:CVE-2021-38536

LAST UPDATE DATE

2024-08-14T15:42:46.330000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2021-38536date:2021-08-19T00:00:00
db:JVNDBid:JVNDB-2021-010440date:2022-07-01T06:11:00
db:CNNVDid:CNNVD-202108-943date:2021-08-26T00:00:00
db:NVDid:CVE-2021-38536date:2021-08-19T16:17:59.127

SOURCES RELEASE DATE

db:VULMONid:CVE-2021-38536date:2021-08-11T00:00:00
db:JVNDBid:JVNDB-2021-010440date:2022-07-01T00:00:00
db:CNNVDid:CNNVD-202108-943date:2021-08-10T00:00:00
db:NVDid:CVE-2021-38536date:2021-08-11T00:17:31.773