Sign-up

ID

VAR-202108-1627


CVE

CVE-2021-38521


TITLE

plural  NETGEAR  Command injection vulnerability in device

Trust: 0.8

sources: JVNDB: JVNDB-2021-010409

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.50, R7900P before 1.4.1.50, R8000P before 1.4.1.50, RAX75 before 1.0.1.62, and RAX80 before 1.0.1.62. plural NETGEAR A command injection vulnerability exists in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Netgear NETGEAR is a router from Netgear. A hardware device that connects two or more networks and acts as a gateway between the networks. Many NETGEAR devices have security vulnerabilities. The vulnerability stems from the fact that the product does not filter special characters in user input data. Attackers can execute system commands through this vulnerability. This affects R6400 prior to 1.0.1.50, R7900P prior to 1.4.1.50, R8000P prior to 1.4.1.50, RAX75 prior to 1.0.1.62, and RAX80 prior to 1.0.1.62

Trust: 2.25

sources: NVD: CVE-2021-38521 // JVNDB: JVNDB-2021-010409 // CNVD: CNVD-2021-83562 // VULMON: CVE-2021-38521

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-83562

AFFECTED PRODUCTS

vendor:netgearmodel:r6400scope:ltversion:1.0.1.50

Trust: 1.6

vendor:netgearmodel:r7900pscope:ltversion:1.4.1.50

Trust: 1.6

vendor:netgearmodel:r8000pscope:ltversion:1.4.1.50

Trust: 1.6

vendor:netgearmodel:rax75scope:ltversion:1.0.1.62

Trust: 1.6

vendor:netgearmodel:rax80scope:ltversion:1.0.1.62

Trust: 1.6

vendor:ネットギアmodel:r8000pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r7900pscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax75scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:r6400scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rax80scope: - version: -

Trust: 0.8

sources: CNVD: CNVD-2021-83562 // JVNDB: JVNDB-2021-010409 // NVD: CVE-2021-38521

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-38521
value: HIGH

Trust: 1.0

cve@mitre.org: CVE-2021-38521
value: MEDIUM

Trust: 1.0

NVD: CVE-2021-38521
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-83562
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202108-1046
value: HIGH

Trust: 0.6

VULMON: CVE-2021-38521
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-38521
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-83562
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-38521
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.9
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2021-38521
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
exploitabilityScore: 0.6
impactScore: 5.5
version: 3.1

Trust: 1.0

NVD: CVE-2021-38521
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-83562 // VULMON: CVE-2021-38521 // JVNDB: JVNDB-2021-010409 // CNNVD: CNNVD-202108-1046 // NVD: CVE-2021-38521 // NVD: CVE-2021-38521

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-010409 // NVD: CVE-2021-38521

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202108-1046

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202108-1046

PATCH

title:Security Advisory for Post-Authentication Command Injection on Some Routers, PSV-2018-0566url:https://kb.netgear.com/000063764/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0566

Trust: 0.8

title:Patch for Command injection vulnerabilities in multiple NETGEAR productsurl:https://www.cnvd.org.cn/patchInfo/show/296266

Trust: 0.6

title:Netgear NETGEAR Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=159420

Trust: 0.6

sources: CNVD: CNVD-2021-83562 // JVNDB: JVNDB-2021-010409 // CNNVD: CNNVD-202108-1046

EXTERNAL IDS

db:NVDid:CVE-2021-38521

Trust: 3.9

db:JVNDBid:JVNDB-2021-010409

Trust: 0.8

db:CNVDid:CNVD-2021-83562

Trust: 0.6

db:CNNVDid:CNNVD-202108-1046

Trust: 0.6

db:VULMONid:CVE-2021-38521

Trust: 0.1

sources: CNVD: CNVD-2021-83562 // VULMON: CVE-2021-38521 // JVNDB: JVNDB-2021-010409 // CNNVD: CNNVD-202108-1046 // NVD: CVE-2021-38521

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2021-38521

Trust: 2.0

url:https://kb.netgear.com/000063764/security-advisory-for-post-authentication-command-injection-on-some-routers-psv-2018-0566

Trust: 1.7

url:https://cwe.mitre.org/data/definitions/77.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-83562 // VULMON: CVE-2021-38521 // JVNDB: JVNDB-2021-010409 // CNNVD: CNNVD-202108-1046 // NVD: CVE-2021-38521

SOURCES

db:CNVDid:CNVD-2021-83562
db:VULMONid:CVE-2021-38521
db:JVNDBid:JVNDB-2021-010409
db:CNNVDid:CNNVD-202108-1046
db:NVDid:CVE-2021-38521

LAST UPDATE DATE

2024-08-14T13:23:24.044000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-83562date:2021-11-04T00:00:00
db:VULMONid:CVE-2021-38521date:2021-08-18T00:00:00
db:JVNDBid:JVNDB-2021-010409date:2022-06-30T09:09:00
db:CNNVDid:CNNVD-202108-1046date:2021-08-19T00:00:00
db:NVDid:CVE-2021-38521date:2021-08-18T19:52:08.040

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-83562date:2021-08-12T00:00:00
db:VULMONid:CVE-2021-38521date:2021-08-11T00:00:00
db:JVNDBid:JVNDB-2021-010409date:2022-06-30T00:00:00
db:CNNVDid:CNNVD-202108-1046date:2021-08-10T00:00:00
db:NVDid:CVE-2021-38521date:2021-08-11T00:15:50.117