Details of VAR-202112-2325

ID

VAR-202112-2325

CVE

CVE-2021-45624

TITLE

plural NETGEAR Command injection vulnerability in device

Trust: 0.8

sources: JVNDB: JVNDB-2021-017089

DESCRIPTION

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.66, D8500 before 1.0.3.58, R7000 before 1.0.11.110, R7100LG before 1.0.0.72, R7900 before 1.0.4.30, R8000 before 1.0.4.62, XR300 before 1.0.3.56, R7000P before 1.3.2.132, R8500 before 1.0.2.144, R6900P before 1.3.2.132, and R8300 before 1.0.2.144. plural NETGEAR A command injection vulnerability exists in the device.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This affects D7000v2 prior to 1.0.0.66, D8500 prior to 1.0.3.58, R7000 prior to 1.0.11.110, R7100LG prior to 1.0.0.72, R7900 prior to 1.0.4.30, R8000 prior to 1.0.4.62, XR300 prior to 1.0.3.56, R7000P prior to 1.3.2.132, R8500 prior to 1.0.2.144, R6900P prior to 1.3.2.132, and R8300 prior to 1.0.2.144

Trust: 1.71

sources: NVD: CVE-2021-45624 // JVNDB: JVNDB-2021-017089 // VULMON: CVE-2021-45624

AFFECTED PRODUCTS

vendor:	netgear	model:	xr300	scope:	lt	version:	1.0.3.56	Trust: 1.0
vendor:	netgear	model:	r8500	scope:	lt	version:	1.0.2.144	Trust: 1.0
vendor:	netgear	model:	r7000p	scope:	lt	version:	1.3.2.132	Trust: 1.0
vendor:	netgear	model:	r6900p	scope:	lt	version:	1.3.2.132	Trust: 1.0
vendor:	netgear	model:	r7900	scope:	lt	version:	1.0.4.30	Trust: 1.0
vendor:	netgear	model:	r8000	scope:	lt	version:	1.0.4.62	Trust: 1.0
vendor:	netgear	model:	d8500	scope:	lt	version:	1.0.3.58	Trust: 1.0
vendor:	netgear	model:	r8300	scope:	lt	version:	1.0.2.144	Trust: 1.0
vendor:	netgear	model:	r7100lg	scope:	lt	version:	1.0.0.72	Trust: 1.0
vendor:	netgear	model:	d7000v2	scope:	lt	version:	1.0.0.66	Trust: 1.0
vendor:	netgear	model:	r7000	scope:	lt	version:	1.0.11.110	Trust: 1.0
vendor:	ネットギア	model:	d8500	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	xr300	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	d7000v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8500	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7100lg	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7000p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7900	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7000	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6900p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r8000	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-017089 // NVD: CVE-2021-45624

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-45624
value:	CRITICAL
Trust: 1.0
cve@mitre.org:	CVE-2021-45624
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2021-45624
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-202112-2423
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2021-45624
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-45624
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2021-45624
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2021-45624
baseSeverity:	CRITICAL
baseScore:	9.6
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	6.0
version:	3.1
Trust: 1.0
NVD:	CVE-2021-45624
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2021-45624 // JVNDB: JVNDB-2021-017089 // CNNVD: CNNVD-202112-2423 // NVD: CVE-2021-45624 // NVD: CVE-2021-45624

PROBLEMTYPE DATA

problemtype:	CWE-77	Trust: 1.0
problemtype:	Command injection (CWE-77) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-017089 // NVD: CVE-2021-45624

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-2423

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202112-2423

PATCH

title:	Security Advisory for Pre-Authentication Command Injection on Some Routers, PSV-2020-0298	url:	https://kb.netgear.com/000064485/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0298	Trust: 0.8
title:	Netgear NETGEAR Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=176402	Trust: 0.6

sources: JVNDB: JVNDB-2021-017089 // CNNVD: CNNVD-202112-2423

EXTERNAL IDS

db:	NVD	id:	CVE-2021-45624	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-017089	Trust: 0.8
db:	CNNVD	id:	CNNVD-202112-2423	Trust: 0.6
db:	VULMON	id:	CVE-2021-45624	Trust: 0.1

sources: VULMON: CVE-2021-45624 // JVNDB: JVNDB-2021-017089 // CNNVD: CNNVD-202112-2423 // NVD: CVE-2021-45624

REFERENCES

url:	https://kb.netgear.com/000064485/security-advisory-for-pre-authentication-command-injection-on-some-routers-psv-2020-0298	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-45624	Trust: 1.4
url:	https://cwe.mitre.org/data/definitions/77.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2021-45624 // JVNDB: JVNDB-2021-017089 // CNNVD: CNNVD-202112-2423 // NVD: CVE-2021-45624

SOURCES

db:	VULMON	id:	CVE-2021-45624
db:	JVNDB	id:	JVNDB-2021-017089
db:	CNNVD	id:	CNNVD-202112-2423
db:	NVD	id:	CVE-2021-45624

LAST UPDATE DATE

2024-11-23T22:47:32.708000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2021-45624	date:	2022-01-05T00:00:00
db:	JVNDB	id:	JVNDB-2021-017089	date:	2023-01-04T01:52:00
db:	CNNVD	id:	CNNVD-202112-2423	date:	2022-01-06T00:00:00
db:	NVD	id:	CVE-2021-45624	date:	2024-11-21T06:32:42.523

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2021-45624	date:	2021-12-26T00:00:00
db:	JVNDB	id:	JVNDB-2021-017089	date:	2023-01-04T00:00:00
db:	CNNVD	id:	CNNVD-202112-2423	date:	2021-12-26T00:00:00
db:	NVD	id:	CVE-2021-45624	date:	2021-12-26T01:15:18.917