Sign-up

ID

VAR-202112-2323


CVE

CVE-2021-45626


TITLE

plural  NETGEAR  Command injection vulnerability in device

Trust: 0.8

sources: JVNDB: JVNDB-2021-017090

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK20 before 2.6.1.36, RBR20 before 2.6.1.36, RBS20 before 2.6.1.38, RBK40 before 2.6.1.36, RBR40 before 2.6.1.36, RBS40 before 2.6.1.38, RBK50 before 2.6.1.40, RBR50 before 2.6.1.40, RBS50 before 2.6.1.40, and RBS50Y before 2.6.1.40. plural NETGEAR A command injection vulnerability exists in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This affects RBK20 prior to 2.6.1.36, RBR20 prior to 2.6.1.36, RBS20 prior to 2.6.1.38, RBK40 prior to 2.6.1.36, RBR40 prior to 2.6.1.36, RBS40 prior to 2.6.1.38, RBK50 prior to 2.6.1.40, RBR50 prior to 2.6.1.40, RBS50 prior to 2.6.1.40, and RBS50Y prior to 2.6.1.40

Trust: 1.71

sources: NVD: CVE-2021-45626 // JVNDB: JVNDB-2021-017090 // VULMON: CVE-2021-45626

AFFECTED PRODUCTS

vendor:netgearmodel:rbs50yscope:ltversion:2.6.1.40

Trust: 1.0

vendor:netgearmodel:rbr50scope:ltversion:2.6.1.40

Trust: 1.0

vendor:netgearmodel:rbr40scope:ltversion:2.6.1.36

Trust: 1.0

vendor:netgearmodel:rbk20scope:ltversion:2.6.1.38

Trust: 1.0

vendor:netgearmodel:rbs20scope:ltversion:2.6.1.38

Trust: 1.0

vendor:netgearmodel:rbs40scope:ltversion:2.6.1.38

Trust: 1.0

vendor:netgearmodel:rbk40scope:ltversion:2.6.1.38

Trust: 1.0

vendor:netgearmodel:rbs50scope:ltversion:2.6.1.40

Trust: 1.0

vendor:netgearmodel:rbk50scope:ltversion:2.6.1.40

Trust: 1.0

vendor:netgearmodel:rbr20scope:ltversion:2.6.1.36

Trust: 1.0

vendor:ネットギアmodel:rbs50yscope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbs50scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr40scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk20scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk40scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbk50scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbs20scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr20scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbs40scope: - version: -

Trust: 0.8

vendor:ネットギアmodel:rbr50scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-017090 // NVD: CVE-2021-45626

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-45626
value: HIGH

Trust: 1.0

cve@mitre.org: CVE-2021-45626
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-45626
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202112-2420
value: HIGH

Trust: 0.6

VULMON: CVE-2021-45626
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-45626
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

nvd@nist.gov: CVE-2021-45626
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

cve@mitre.org: CVE-2021-45626
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2021-45626
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2021-45626 // JVNDB: JVNDB-2021-017090 // CNNVD: CNNVD-202112-2420 // NVD: CVE-2021-45626 // NVD: CVE-2021-45626

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.0

problemtype:Command injection (CWE-77) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-017090 // NVD: CVE-2021-45626

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202112-2420

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202112-2420

PATCH

title:Security Advisory for Pre-Authentication Command Injection on Some WiFi Systems, PSV-2019-0152url:https://kb.netgear.com/000064068/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2019-0152

Trust: 0.8

title:Netgear NETGEAR Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176399

Trust: 0.6

sources: JVNDB: JVNDB-2021-017090 // CNNVD: CNNVD-202112-2420

EXTERNAL IDS

db:NVDid:CVE-2021-45626

Trust: 3.3

db:JVNDBid:JVNDB-2021-017090

Trust: 0.8

db:CNNVDid:CNNVD-202112-2420

Trust: 0.6

db:VULMONid:CVE-2021-45626

Trust: 0.1

sources: VULMON: CVE-2021-45626 // JVNDB: JVNDB-2021-017090 // CNNVD: CNNVD-202112-2420 // NVD: CVE-2021-45626

REFERENCES

url:https://kb.netgear.com/000064068/security-advisory-for-pre-authentication-command-injection-on-some-wifi-systems-psv-2019-0152

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-45626

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/77.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2021-45626 // JVNDB: JVNDB-2021-017090 // CNNVD: CNNVD-202112-2420 // NVD: CVE-2021-45626

SOURCES

db:VULMONid:CVE-2021-45626
db:JVNDBid:JVNDB-2021-017090
db:CNNVDid:CNNVD-202112-2420
db:NVDid:CVE-2021-45626

LAST UPDATE DATE

2024-11-23T23:03:57.946000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2021-45626date:2022-01-05T00:00:00
db:JVNDBid:JVNDB-2021-017090date:2023-01-04T01:52:00
db:CNNVDid:CNNVD-202112-2420date:2022-01-06T00:00:00
db:NVDid:CVE-2021-45626date:2024-11-21T06:32:42.840

SOURCES RELEASE DATE

db:VULMONid:CVE-2021-45626date:2021-12-26T00:00:00
db:JVNDBid:JVNDB-2021-017090date:2023-01-04T00:00:00
db:CNNVDid:CNNVD-202112-2420date:2021-12-26T00:00:00
db:NVDid:CVE-2021-45626date:2021-12-26T01:15:19.007