CVE-2021-38521

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

0.87%

Published

Aug 10, 2021

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.50, R7900P before 1.4.1.50, R8000P before 1.4.1.50, RAX75 before 1.0.1.62, and RAX80 before 1.0.1.62.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

Weaknesses (CWE)

CWE-77

Affected Products (10)

netgear · r6400_firmware (up to 1.0.1.50)vulnerable

netgear · r6400

netgear · r7900p_firmware (up to 1.4.1.50)vulnerable

netgear · r7900p

netgear · r8000p_firmware (up to 1.4.1.50)vulnerable

netgear · r8000p

netgear · rax75_firmware (up to 1.0.1.62)vulnerable

netgear · rax75

netgear · rax80_firmware (up to 1.0.1.62)vulnerable

netgear · rax80

References (2)

https://kb.netgear.com/000063764/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0566

Vendor Advisory

https://kb.netgear.com/000063764/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2018-0566

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs