Vulnerability Description
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netgear | Br200 Firmware | < 5.10.0.5 |
| Netgear | Br200 | - |
| Netgear | Br500 Firmware | < 5.10.0.5 |
| Netgear | Br500 | - |
| Netgear | D7800 Firmware | < 1.0.1.60 |
| Netgear | D7800 | - |
| Netgear | Ex6100V2 Firmware | < 1.0.1.98 |
| Netgear | Ex6100V2 | - |
| Netgear | Ex6150V2 Firmware | < 1.0.1.98 |
| Netgear | Ex6150V2 | - |
| Netgear | Ex6250 Firmware | < 1.0.0.134 |
| Netgear | Ex6250 | - |
| Netgear | Ex6400 Firmware | < 1.0.2.158 |
| Netgear | Ex6400 | - |
| Netgear | Ex6400V2 Firmware | < 1.0.0.134 |
| Netgear | Ex6400V2 | - |
| Netgear | Ex6410 Firmware | < 1.0.0.134 |
| Netgear | Ex6410 | - |
| Netgear | Ex6420 Firmware | < 1.0.0.134 |
| Netgear | Ex6420 | - |
Related Weaknesses (CWE)
References
- https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-PatchVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-252/Third Party AdvisoryVDB Entry
- https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-PatchVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-252/Third Party AdvisoryVDB Entry
FAQ
What is CVE-2021-27254?
CVE-2021-27254 is a vulnerability with a CVSS score of 8.8 (HIGH). This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific fla...
How severe is CVE-2021-27254?
CVE-2021-27254 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27254?
Check the references section above for vendor advisories and patch information. Affected products include: Netgear Br200 Firmware, Netgear Br200, Netgear Br500 Firmware, Netgear Br500, Netgear D7800 Firmware.