VulnerabilityModified

CVE-2018-21226

Certain NETGEAR devices are affected by authentication bypass.

HIGH 8.8EPSS 0.70%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.70%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Certain NETGEAR devices are affected by authentication bypass. This affects JNR1010v2 before 1.1.0.48, JWNR2010v5 before 1.1.0.48, WNR1000v4 before 1.1.0.48, WNR2020 before 1.1.0.48, and WNR2050 before 1.1.0.48.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.70% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-269
Affected: netgear/jnr1010 firmware · netgear/jwnr2010 firmware · netgear/wnr1000 firmware · netgear/wnr2020 firmware · netgear/wnr2050 firmware
Source: cve@mitre.org

References

https://kb.netgear.com/000055110/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0748Vendor Advisory
https://kb.netgear.com/000055110/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2017-0748Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.