Details of VAR-202112-2222

ID

VAR-202112-2222

CVE

CVE-2021-45499

TITLE

plural NETGEAR Vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2021-017138

DESCRIPTION

Certain NETGEAR devices are affected by authentication bypass. This affects R6900P before 1.3.3.140, R7000P before 1.3.3.140, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000P before 1.4.2.84, RAX75 before 1.0.3.106, and RAX80 before 1.0.3.106. plural NETGEAR There is an unspecified vulnerability in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This affects R6900P prior to 1.3.3.140, R7000P prior to 1.3.3.140, R7900P prior to 1.4.2.84, R7960P prior to 1.4.2.84, R8000P prior to 1.4.2.84, RAX75 prior to 1.0.3.106, and RAX80 prior to 1.0.3.106

Trust: 1.71

sources: NVD: CVE-2021-45499 // JVNDB: JVNDB-2021-017138 // VULMON: CVE-2021-45499

AFFECTED PRODUCTS

vendor:	netgear	model:	r7900p	scope:	lt	version:	1.4.2.84	Trust: 1.0
vendor:	netgear	model:	r6900p	scope:	lt	version:	1.3.3.140	Trust: 1.0
vendor:	netgear	model:	rax80	scope:	lt	version:	1.0.3.106	Trust: 1.0
vendor:	netgear	model:	r7960p	scope:	lt	version:	1.4.2.84	Trust: 1.0
vendor:	netgear	model:	rax75	scope:	lt	version:	1.0.3.106	Trust: 1.0
vendor:	netgear	model:	r8000p	scope:	lt	version:	1.4.2.84	Trust: 1.0
vendor:	netgear	model:	r7000p	scope:	lt	version:	1.3.3.140	Trust: 1.0
vendor:	ネットギア	model:	r8000p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6900p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7000p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax80	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7900p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax75	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7960p	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-017138 // NVD: CVE-2021-45499

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-45499
value:	HIGH
Trust: 1.0
cve@mitre.org:	CVE-2021-45499
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-45499
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202112-2314
value:	HIGH
Trust: 0.6
VULMON:	CVE-2021-45499
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-45499
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2021-45499
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2021-45499
baseSeverity:	HIGH
baseScore:	8.2
vectorString:	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	5.8
version:	3.1
Trust: 1.0
NVD:	CVE-2021-45499
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2021-45499 // JVNDB: JVNDB-2021-017138 // CNNVD: CNNVD-202112-2314 // NVD: CVE-2021-45499 // NVD: CVE-2021-45499

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-017138 // NVD: CVE-2021-45499

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-2314

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202112-2314

PATCH

title:	Security Advisory for Authentication Bypass on Some Routers, PSV-2019-0027	url:	https://kb.netgear.com/000064445/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2019-0027	Trust: 0.8
title:	Netgear NETGEAR Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176018	Trust: 0.6

sources: JVNDB: JVNDB-2021-017138 // CNNVD: CNNVD-202112-2314

EXTERNAL IDS

db:	NVD	id:	CVE-2021-45499	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-017138	Trust: 0.8
db:	CNNVD	id:	CNNVD-202112-2314	Trust: 0.6
db:	VULMON	id:	CVE-2021-45499	Trust: 0.1

sources: VULMON: CVE-2021-45499 // JVNDB: JVNDB-2021-017138 // CNNVD: CNNVD-202112-2314 // NVD: CVE-2021-45499

REFERENCES

url:	https://kb.netgear.com/000064445/security-advisory-for-authentication-bypass-on-some-routers-psv-2019-0027	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-45499	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/287.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2021-45499 // JVNDB: JVNDB-2021-017138 // CNNVD: CNNVD-202112-2314 // NVD: CVE-2021-45499

SOURCES

db:	VULMON	id:	CVE-2021-45499
db:	JVNDB	id:	JVNDB-2021-017138
db:	CNNVD	id:	CNNVD-202112-2314
db:	NVD	id:	CVE-2021-45499

LAST UPDATE DATE

2024-11-23T23:07:30.699000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2021-45499	date:	2022-01-05T00:00:00
db:	JVNDB	id:	JVNDB-2021-017138	date:	2023-01-05T02:24:00
db:	CNNVD	id:	CNNVD-202112-2314	date:	2022-07-14T00:00:00
db:	NVD	id:	CVE-2021-45499	date:	2024-11-21T06:32:21.070

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2021-45499	date:	2021-12-26T00:00:00
db:	JVNDB	id:	JVNDB-2021-017138	date:	2023-01-05T00:00:00
db:	CNNVD	id:	CNNVD-202112-2314	date:	2021-12-26T00:00:00
db:	NVD	id:	CVE-2021-45499	date:	2021-12-26T01:15:12.830