9.8
CRITICAL
CVE-2021-45619
NETGEAR Command Injection Vulnerability
Description

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects EX6200v2 before 1.0.1.86, EX6250 before 1.0.0.134, EX7700 before 1.0.0.216, EX8000 before 1.0.1.232, LBR1020 before 2.6.3.58, LBR20 before 2.6.3.50, R7800 before 1.0.2.80, R8900 before 1.0.5.26, R9000 before 1.0.5.26, RBS50Y before 2.7.3.22, WNR2000v5 before 1.0.0.76, XR700 before 1.0.1.36, EX6150v2 before 1.0.1.98, EX7300 before 1.0.2.158, EX7320 before 1.0.0.134, RAX10 before 1.0.2.88, RAX120 before 1.2.0.16, RAX70 before 1.0.2.88, EX6100v2 before 1.0.1.98, EX6400 before 1.0.2.158, EX7300v2 before 1.0.0.134, R6700AX before 1.0.2.88, RAX120v2 before 1.2.0.16, RAX78 before 1.0.2.88, EX6410 before 1.0.0.134, RBR10 before 2.7.3.22, RBR20 before 2.7.3.22, RBR350 before 4.3.4.7, RBR40 before 2.7.3.22, RBR50 before 2.7.3.22, EX6420 before 1.0.0.134, RBS10 before 2.7.3.22, RBS20 before 2.7.3.22, RBS350 before 4.3.4.7, RBS40 before 2.7.3.22, RBS50 before 2.7.3.22, EX6400v2 before 1.0.0.134, RBK12 before 2.7.3.22, RBK20 before 2.7.3.22, RBK352 before 4.3.4.7, RBK40 before 2.7.3.22, and RBK50 before 2.7.3.22.

INFO

Published Date :

Dec. 26, 2021, 1:15 a.m.

Last Modified :

Nov. 21, 2024, 6:32 a.m.

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
Affected Products

The following products are affected by CVE-2021-45619 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Netgear r7800_firmware
2 Netgear ex8000_firmware
3 Netgear r8900_firmware
4 Netgear r9000_firmware
5 Netgear rax120_firmware
6 Netgear rbk12_firmware
7 Netgear rbr10_firmware
8 Netgear rbs10_firmware
9 Netgear rbk20_firmware
10 Netgear rbr20_firmware
11 Netgear rbs20_firmware
12 Netgear rbk40_firmware
13 Netgear rbr40_firmware
14 Netgear rbs40_firmware
15 Netgear rbk50_firmware
16 Netgear rbr50_firmware
17 Netgear rbs50_firmware
18 Netgear xr700_firmware
19 Netgear ex6100v2_firmware
20 Netgear ex6150v2_firmware
21 Netgear ex6200v2_firmware
22 Netgear ex6400_firmware
23 Netgear ex7300_firmware
24 Netgear wnr2000v5_firmware
25 Netgear ex6250_firmware
26 Netgear ex6400v2_firmware
27 Netgear ex6410_firmware
28 Netgear ex7300v2_firmware
29 Netgear ex7320_firmware
30 Netgear ex7700_firmware
31 Netgear rbs50y_firmware
32 Netgear ex6420_firmware
33 Netgear lbr20_firmware
34 Netgear lbr1020_firmware
35 Netgear rbk352_firmware
36 Netgear rbr350_firmware
37 Netgear rbs350_firmware
38 Netgear r6700ax_firmware
39 Netgear rax10_firmware
40 Netgear rax120v2_firmware
41 Netgear rax70_firmware
42 Netgear rax78_firmware
43 Netgear wnr2000v5
44 Netgear r9000
45 Netgear r8900
46 Netgear r7800
47 Netgear rax120
48 Netgear xr700
49 Netgear rbr20
50 Netgear rbs20
51 Netgear rbk20
52 Netgear rbr40
53 Netgear rbs40
54 Netgear rbk40
55 Netgear rbr50
56 Netgear rbs50
57 Netgear rbk50
58 Netgear ex6400
59 Netgear ex7300
60 Netgear ex8000
61 Netgear rbs50y
62 Netgear ex7700
63 Netgear rbk12
64 Netgear rbr10
65 Netgear rbs10
66 Netgear ex6100v2
67 Netgear ex6150v2
68 Netgear ex6200v2
69 Netgear ex6250
70 Netgear ex6400v2
71 Netgear ex6410
72 Netgear ex7300v2
73 Netgear ex7320
74 Netgear ex6420
75 Netgear lbr20
76 Netgear rbk352
77 Netgear rbr350
78 Netgear rbs350
79 Netgear lbr1020
80 Netgear r6700ax
81 Netgear rax10
82 Netgear rax120v2
83 Netgear rax70
84 Netgear rax78
References to Advisories, Solutions, and Tools

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2021-45619 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2021-45619 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://kb.netgear.com/000064492/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0435
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Initial Analysis by [email protected]

    Jan. 10, 2022

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:N/AC:L/Au:N/C:C/I:C/A:C)
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://kb.netgear.com/000064492/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0435 No Types Assigned https://kb.netgear.com/000064492/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-Extenders-and-WiFi-Systems-PSV-2020-0435 Vendor Advisory
    Added CWE NIST CWE-77
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6250_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.134 OR cpe:2.3:h:netgear:ex6250:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex7700_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.216 OR cpe:2.3:h:netgear:ex7700:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex8000_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.1.232 OR cpe:2.3:h:netgear:ex8000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.6.3.58 OR cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.6.3.50 OR cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.2.80 OR cpe:2.3:h:netgear:r7800:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:r8900_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.5.26 OR cpe:2.3:h:netgear:r8900:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbs50y_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbs50y:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:wnr2000v5_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.76 OR cpe:2.3:h:netgear:wnr2000v5:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:xr700_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.1.36 OR cpe:2.3:h:netgear:xr700:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6150v2_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.1.98 OR cpe:2.3:h:netgear:ex6150v2:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex7300_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.2.158 OR cpe:2.3:h:netgear:ex7300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex7320_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.134 OR cpe:2.3:h:netgear:ex7320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rax10_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.2.88 OR cpe:2.3:h:netgear:rax10:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rax120_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.2.0.16 OR cpe:2.3:h:netgear:rax120:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rax70_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.2.88 OR cpe:2.3:h:netgear:rax70:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6100v2_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.1.98 OR cpe:2.3:h:netgear:ex6100v2:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6400_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.2.158 OR cpe:2.3:h:netgear:ex6400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex7300v2_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.134 OR cpe:2.3:h:netgear:ex7300v2:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:r6700ax_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.2.88 OR cpe:2.3:h:netgear:r6700ax:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rax120v2_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.2.0.16 OR cpe:2.3:h:netgear:rax120v2:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rax78_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.2.88 OR cpe:2.3:h:netgear:rax78:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6410_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.134 OR cpe:2.3:h:netgear:ex6410:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbr10_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbr10:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbr20_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbr20:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbr350_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 4.3.4.7 OR cpe:2.3:h:netgear:rbr350:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbr40_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbr40:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbr50_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbr50:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6420_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.134 OR cpe:2.3:h:netgear:ex6420:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbs10_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbs10:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbs20_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbs20:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbs350_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 4.3.4.7 OR cpe:2.3:h:netgear:rbs350:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbs40_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbs40:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbs50_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbs50:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6400v2_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.0.134 OR cpe:2.3:h:netgear:ex6400v2:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbk12_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbk12:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbk20_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbk20:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbk352_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 4.3.4.7 OR cpe:2.3:h:netgear:rbk352:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbk40_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbk40:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:rbk50_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 2.7.3.22 OR cpe:2.3:h:netgear:rbk50:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:ex6200v2_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.1.86 OR cpe:2.3:h:netgear:ex6200v2:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.0.5.26 OR cpe:2.3:h:netgear:r9000:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2021-45619 is associated with the following CWEs:

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.53 }} 0.16%

score

0.77355

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability