Vulnerability Description
Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB2700, NB2710, NB2800, NB2810, NB3700, NB3701, NB3710, NB3711, NB3720, and NB3800.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netmodule | Netmodule Router Software | < 4.3.0.113 |
| Netmodule | Nb1600 | - |
| Netmodule | Nb1601 | - |
| Netmodule | Nb1800 | - |
| Netmodule | Nb1810 | - |
| Netmodule | Nb2700 | - |
| Netmodule | Nb2710 | - |
| Netmodule | Nb2800 | - |
| Netmodule | Nb2810 | - |
| Netmodule | Nb3700 | - |
| Netmodule | Nb3701 | - |
| Netmodule | Nb3710 | - |
| Netmodule | Nb3711 | - |
| Netmodule | Nb3720 | - |
| Netmodule | Nb3800 | - |
| Netmodule | Nb800 | - |
Related Weaknesses (CWE)
References
- https://seclists.org/fulldisclosure/2021/Aug/22ExploitMailing ListThird Party Advisory
- https://www.netmodule.comVendor Advisory
- https://seclists.org/fulldisclosure/2021/Aug/22ExploitMailing ListThird Party Advisory
- https://www.netmodule.comVendor Advisory
FAQ
What is CVE-2021-39291?
CVE-2021-39291 is a vulnerability with a CVSS score of 8.8 (HIGH). Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected: NB800, NB1600, NB1601, NB1800, NB1810, NB...
How severe is CVE-2021-39291?
CVE-2021-39291 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-39291?
Check the references section above for vendor advisories and patch information. Affected products include: Netmodule Netmodule Router Software, Netmodule Nb1600, Netmodule Nb1601, Netmodule Nb1800, Netmodule Nb1810.