CVE-2021-45614

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-45614
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, RAX15 before 1.0.3.96, RAX20 before 1.0.3.96, RAX200 before 1.0.4.120, RAX45 before 1.0.3.96, RAX50 before 1.0.3.96, RAX43 before 1.0.3.96, RAX40v2 before 1.0.3.96, RAX35v2 before 1.0.3.96, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, and XR1000 before 1.0.0.58.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
https://kb.netgear.com/000064141/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2020-0520 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:netgear:d7000v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:d7000v2:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netgear:lax20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:lax20:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netgear:mk62_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:mk62:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netgear:mr60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:mr60:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netgear:ms60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ms60:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netgear:rax15_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax15:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netgear:rax20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax20:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netgear:rax200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax200:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netgear:rax45_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax45:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netgear:rax50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax50:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:netgear:rax43_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax43:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:netgear:rax40v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax40v2:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:netgear:rax35v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax35v2:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:netgear:rax75_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax75:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:netgear:rax80_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax80:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:netgear:rbk752_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbk752:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:netgear:rbr750_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbr750:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:netgear:rbs750_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbs750:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:netgear:rbk852_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbk852:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:netgear:rbr850_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbr850:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:netgear:rbs850_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbs850:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr1000:-:*:*:*:*:*:*:*
History

10 Jan 2022, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 10.0
v3 : 9.8
References (MISC) https://kb.netgear.com/000064141/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2020-0520 - (MISC) https://kb.netgear.com/000064141/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2020-0520 - Vendor Advisory
CWE CWE-77
CPE cpe:2.3:h:netgear:rax43:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax75_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:d7000v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax43_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rbr750_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rbs750_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rbr850_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbk752:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:lax20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax15:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax50_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbr750:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax80_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax75:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:lax20:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:mr60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax200_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax50:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax35v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax35v2:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax20_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax45:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax200:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax15_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax20:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rbs850_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbr850:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:mr60:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:ms60:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbk852:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax45_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rbk752_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbs850:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:mk62:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rax40v2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rbs750:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:mk62_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax80:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:d7000v2:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:ms60_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:netgear:rax40v2:-:*:*:*:*:*:*:*
cpe:2.3:h:netgear:xr1000:-:*:*:*:*:*:*:*
cpe:2.3:o:netgear:xr1000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:netgear:rbk852_firmware:*:*:*:*:*:*:*:*
First Time Netgear rbk752 Firmware
Netgear mr60
Netgear rax80
Netgear rbr750 Firmware
Netgear rbs850
Netgear rbs750 Firmware
Netgear
Netgear rax80 Firmware
Netgear d7000v2
Netgear rax15 Firmware
Netgear lax20
Netgear rax20
Netgear rax200 Firmware
Netgear lax20 Firmware
Netgear rbs750
Netgear d7000v2 Firmware
Netgear rax40v2 Firmware
Netgear rax50 Firmware
Netgear rax40v2
Netgear rax50
Netgear mk62
Netgear mk62 Firmware
Netgear rbr850
Netgear rax43
Netgear rbs850 Firmware
Netgear rax43 Firmware
Netgear xr1000 Firmware
Netgear rax15
Netgear rax75
Netgear rax35v2
Netgear rax20 Firmware
Netgear ms60
Netgear mr60 Firmware
Netgear xr1000
Netgear rax45 Firmware
Netgear rbr750
Netgear rax45
Netgear rax75 Firmware
Netgear rbk852 Firmware
Netgear rax35v2 Firmware
Netgear ms60 Firmware
Netgear rbk852
Netgear rbr850 Firmware
Netgear rax200
Netgear rbk752

26 Dec 2021, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-12-26 01:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-45614

Mitre link : CVE-2021-45614

CVE.ORG link : CVE-2021-45614

JSON object : View

Products Affected

netgear

  • rbr750
  • mk62
  • rax35v2_firmware
  • rax15_firmware
  • rax40v2
  • rbs750
  • mr60
  • rbs850_firmware
  • rbk752
  • d7000v2_firmware
  • rax40v2_firmware
  • rbr750_firmware
  • rbs750_firmware
  • rbk852_firmware
  • xr1000_firmware
  • ms60
  • rax50
  • rax43
  • rax50_firmware
  • rbr850_firmware
  • rax200_firmware
  • mr60_firmware
  • ms60_firmware
  • rax75
  • rbk852
  • mk62_firmware
  • rbr850
  • rax35v2
  • lax20
  • rax45_firmware
  • rax80_firmware
  • rbk752_firmware
  • rbs850
  • rax20_firmware
  • rax20
  • rax200
  • d7000v2
  • rax15
  • rax45
  • rax80
  • rax43_firmware
  • lax20_firmware
  • xr1000
  • rax75_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')