ID
VAR-202109-1135
CVE
CVE-2021-41314
TITLE
plural NETGEAR Injection Vulnerability in Smart Switch Products
Trust: 0.8
DESCRIPTION
Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2. plural NETGEAR Smart Switch products contain an injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Netgear NETGEAR is a router from Netgear. A hardware device that connects two or more networks and acts as a gateway between the networks. A variety of NETGEAR switches have authorization issue vulnerabilities, which are caused by the failure of the password field in the product's Web UI to correctly process user input data. Attackers can use this vulnerability to cause malicious file creation and privilege escalation. This affects GC108P prior to 1.0.8.2, GC108PP prior to 1.0.8.2, GS108Tv3 prior to 7.0.7.2, GS110TPP prior to 7.0.7.2, GS110TPv3 prior to 7.0.7.2, GS110TUP prior to 1.0.5.3, GS308T prior to 1.0.3.2, GS310TP prior to 1.0.3.2, GS710TUP prior to 1.0.5.3, GS716TP prior to 1.0.4.2, GS716TPP prior to 1.0.4.2, GS724TPP prior to 2.0.6.3, GS724TPv2 prior to 2.0.6.3, GS728TPPv2 prior to 6.0.8.2, GS728TPv2 prior to 6.0.8.2, GS750E prior to 1.0.1.10, GS752TPP prior to 6.0.8.2, GS752TPv2 prior to 6.0.8.2, MS510TXM prior to 1.0.4.2, and MS510TXUP prior to 1.0.4.2
Trust: 2.25
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | netgear | model: | gc108p | scope: | lt | version: | 1.0.8.2 | Trust: 1.6 |
| vendor: | netgear | model: | gc108pp | scope: | lt | version: | 1.0.8.2 | Trust: 1.6 |
| vendor: | netgear | model: | gs110tpp | scope: | lt | version: | 7.0.7.2 | Trust: 1.6 |
| vendor: | netgear | model: | gs110tup | scope: | lt | version: | 1.0.5.3 | Trust: 1.6 |
| vendor: | netgear | model: | gs308t | scope: | lt | version: | 1.0.3.2 | Trust: 1.6 |
| vendor: | netgear | model: | gs310tp | scope: | lt | version: | 1.0.3.2 | Trust: 1.6 |
| vendor: | netgear | model: | gs752tpp | scope: | lt | version: | 6.0.8.2 | Trust: 1.0 |
| vendor: | netgear | model: | gs716tpp | scope: | lt | version: | 1.0.4.2 | Trust: 1.0 |
| vendor: | netgear | model: | gs724tpp | scope: | lt | version: | 2.0.6.3 | Trust: 1.0 |
| vendor: | netgear | model: | ms510txup | scope: | lt | version: | 1.0.4.2 | Trust: 1.0 |
| vendor: | netgear | model: | gs724tp | scope: | lt | version: | 2.0.6.3 | Trust: 1.0 |
| vendor: | netgear | model: | gs750e | scope: | lt | version: | 1.0.1.10 | Trust: 1.0 |
| vendor: | netgear | model: | gs752tp | scope: | lt | version: | 6.0.8.2 | Trust: 1.0 |
| vendor: | netgear | model: | gs728tpp | scope: | lt | version: | 2.0.6.3 | Trust: 1.0 |
| vendor: | netgear | model: | gs728tp | scope: | lt | version: | 2.0.6.3 | Trust: 1.0 |
| vendor: | netgear | model: | gs710tup | scope: | lt | version: | 1.0.5.3 | Trust: 1.0 |
| vendor: | netgear | model: | gs110tp | scope: | lt | version: | 7.0.7.2 | Trust: 1.0 |
| vendor: | netgear | model: | gs716tp | scope: | lt | version: | 1.0.4.2 | Trust: 1.0 |
| vendor: | netgear | model: | ms510txm | scope: | lt | version: | 1.0.4.2 | Trust: 1.0 |
| vendor: | netgear | model: | gs108t | scope: | lt | version: | 7.0.7.2 | Trust: 1.0 |
| vendor: | ネットギア | model: | gs308t | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gs110tp | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gc108p | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gc108pp | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gs108t | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gs710tup | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gs310tp | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gs110tup | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gs110tpp | scope: | - | version: | - | Trust: 0.8 |
| vendor: | ネットギア | model: | gs716tp | scope: | - | version: | - | Trust: 0.8 |
| vendor: | netgear | model: | gs108tv3 | scope: | lt | version: | 7.0.7.2 | Trust: 0.6 |
| vendor: | netgear | model: | gs110tpv3 | scope: | lt | version: | 7.0.7.2 | Trust: 0.6 |
| vendor: | netgear | model: | gs710tup | scope: | lt | version: | 1.0.3.2 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-74 | Trust: 1.0 |
| problemtype: | injection (CWE-74) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
remote or local
Trust: 0.6
TYPE
injection
Trust: 0.6
PATCH
| title: | Security Advisory for Multiple Vulnerabilities on Some Smart Switches, PSV-2021-0140, PSV-2021-0144, PSV-2021-0145 | url: | https://kb.netgear.com/000063978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145 | Trust: 0.8 |
| title: | Patch for Multiple NETGEAR switches have authorization issues vulnerabilities | url: | https://www.cnvd.org.cn/patchInfo/show/296411 | Trust: 0.6 |
| title: | Netgear NETGEAR Remediation measures for authorization problem vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=164282 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-41314 | Trust: 3.9 |
| db: | JVNDB | id: | JVNDB-2021-012359 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2021-83559 | Trust: 0.6 |
| db: | CNNVD | id: | CNNVD-202109-1138 | Trust: 0.6 |
| db: | VULMON | id: | CVE-2021-41314 | Trust: 0.1 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-41314 | Trust: 2.0 |
| url: | https://gynvael.coldwind.pl/?id=742 | Trust: 1.7 |
| url: | https://kb.netgear.com/000063978/security-advisory-for-multiple-vulnerabilities-on-some-smart-switches-psv-2021-0140-psv-2021-0144-psv-2021-0145 | Trust: 1.7 |
| url: | https://cwe.mitre.org/data/definitions/287.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
SOURCES
| db: | CNVD | id: | CNVD-2021-83559 |
| db: | VULMON | id: | CVE-2021-41314 |
| db: | JVNDB | id: | JVNDB-2021-012359 |
| db: | CNNVD | id: | CNNVD-202109-1138 |
| db: | NVD | id: | CVE-2021-41314 |
LAST UPDATE DATE
2024-08-14T14:50:10.509000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2021-83559 | date: | 2021-11-04T00:00:00 |
| db: | VULMON | id: | CVE-2021-41314 | date: | 2021-09-29T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-012359 | date: | 2022-08-30T03:22:00 |
| db: | CNNVD | id: | CNNVD-202109-1138 | date: | 2022-07-14T00:00:00 |
| db: | NVD | id: | CVE-2021-41314 | date: | 2022-07-12T17:42:04.277 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2021-83559 | date: | 2021-09-22T00:00:00 |
| db: | VULMON | id: | CVE-2021-41314 | date: | 2021-09-16T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-012359 | date: | 2022-08-30T00:00:00 |
| db: | CNNVD | id: | CNNVD-202109-1138 | date: | 2021-09-16T00:00:00 |
| db: | NVD | id: | CVE-2021-41314 | date: | 2021-09-16T22:15:08.257 |