Details of VAR-202112-2342

ID

VAR-202112-2342

CVE

CVE-2021-45607

TITLE

plural NETGEAR Out-of-bounds write vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2021-017554

DESCRIPTION

Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6400v2 before 1.0.4.118, R6700v3 before 1.0.4.118, R6900P before 1.3.3.140, R7000 before 1.0.11.126, R7000P before 1.3.3.140, RAX200 before 1.0.5.126, RAX75 before 1.0.5.126, and RAX80 before 1.0.5.126. plural NETGEAR The device contains a vulnerability related to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This affects R6400v2 prior to 1.0.4.118, R6700v3 prior to 1.0.4.118, R6900P prior to 1.3.3.140, R7000 prior to 1.0.11.126, R7000P prior to 1.3.3.140, RAX200 prior to 1.0.5.126, RAX75 prior to 1.0.5.126, and RAX80 prior to 1.0.5.126

Trust: 1.71

sources: NVD: CVE-2021-45607 // JVNDB: JVNDB-2021-017554 // VULMON: CVE-2021-45607

AFFECTED PRODUCTS

vendor:	netgear	model:	r6400v2	scope:	lt	version:	1.0.4.118	Trust: 1.0
vendor:	netgear	model:	r6700v3	scope:	lt	version:	1.0.4.118	Trust: 1.0
vendor:	netgear	model:	rax200	scope:	lt	version:	1.0.5.126	Trust: 1.0
vendor:	netgear	model:	rax75	scope:	lt	version:	1.0.5.126	Trust: 1.0
vendor:	netgear	model:	r6900p	scope:	lt	version:	1.3.3.140	Trust: 1.0
vendor:	netgear	model:	rax80	scope:	lt	version:	1.0.5.126	Trust: 1.0
vendor:	netgear	model:	r7000	scope:	lt	version:	1.0.11.126	Trust: 1.0
vendor:	netgear	model:	r7000p	scope:	lt	version:	1.3.3.140	Trust: 1.0
vendor:	ネットギア	model:	r6400v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax75	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7000p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax200	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7000	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6900p	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6700v3	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	rax80	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-017554 // NVD: CVE-2021-45607

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-45607
value:	HIGH
Trust: 1.0
cve@mitre.org:	CVE-2021-45607
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-45607
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202112-2406
value:	HIGH
Trust: 0.6
VULMON:	CVE-2021-45607
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-45607
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2021-45607
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
cve@mitre.org:	CVE-2021-45607
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2021-45607
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2021-45607 // JVNDB: JVNDB-2021-017554 // CNNVD: CNNVD-202112-2406 // NVD: CVE-2021-45607 // NVD: CVE-2021-45607

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-017554 // NVD: CVE-2021-45607

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202112-2406

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202112-2406

PATCH

title:	Security Advisory for Post-Authentication Stack Overflow on Some Routers, PSV-2021-0128	url:	https://kb.netgear.com/000064531/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2021-0128	Trust: 0.8
title:	Netgear NETGEAR Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=177127	Trust: 0.6

sources: JVNDB: JVNDB-2021-017554 // CNNVD: CNNVD-202112-2406

EXTERNAL IDS

db:	NVD	id:	CVE-2021-45607	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-017554	Trust: 0.8
db:	CNNVD	id:	CNNVD-202112-2406	Trust: 0.6
db:	VULMON	id:	CVE-2021-45607	Trust: 0.1

sources: VULMON: CVE-2021-45607 // JVNDB: JVNDB-2021-017554 // CNNVD: CNNVD-202112-2406 // NVD: CVE-2021-45607

REFERENCES

url:	https://kb.netgear.com/000064531/security-advisory-for-post-authentication-stack-overflow-on-some-routers-psv-2021-0128	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-45607	Trust: 1.4
url:	https://cwe.mitre.org/data/definitions/787.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2021-45607 // JVNDB: JVNDB-2021-017554 // CNNVD: CNNVD-202112-2406 // NVD: CVE-2021-45607

SOURCES

db:	VULMON	id:	CVE-2021-45607
db:	JVNDB	id:	JVNDB-2021-017554
db:	CNNVD	id:	CNNVD-202112-2406
db:	NVD	id:	CVE-2021-45607

LAST UPDATE DATE

2024-11-23T22:36:59.262000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2021-45607	date:	2022-01-07T00:00:00
db:	JVNDB	id:	JVNDB-2021-017554	date:	2023-01-25T05:22:00
db:	CNNVD	id:	CNNVD-202112-2406	date:	2022-01-10T00:00:00
db:	NVD	id:	CVE-2021-45607	date:	2024-11-21T06:32:39.267

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2021-45607	date:	2021-12-26T00:00:00
db:	JVNDB	id:	JVNDB-2021-017554	date:	2023-01-25T00:00:00
db:	CNNVD	id:	CNNVD-202112-2406	date:	2021-12-26T00:00:00
db:	NVD	id:	CVE-2021-45607	date:	2021-12-26T01:15:18.037