CVE-2021-29073
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R8000P before 1.4.1.66, MK62 before 1.0.6.110, MR60 before 1.0.6.110, MS60 before 1.0.6.110, R7960P before 1.4.1.66, R7900P before 1.4.1.66, RAX15 before 1.0.2.82, RAX20 before 1.0.2.82, RAX45 before 1.0.2.72, RAX50 before 1.0.2.72, RAX75 before 1.0.3.106, RAX80 before 1.0.3.106, and RAX200 before 1.0.3.106.
- CVSS 3.1
- 8.4 HIGHCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.34% probability · 27th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- netgear/r8000p firmware · netgear/mk62 firmware · netgear/mr60 firmware · netgear/ms60 firmware · netgear/r7960p firmware · netgear/r7900p firmware · netgear/rax15 firmware · netgear/rax20 firmware · netgear/rax45 firmware · netgear/rax50 firmware · netgear/rax75 firmware · netgear/rax80 firmware · netgear/rax200 firmware
- Source
- cve@mitre.org
References
- https://kb.netgear.com/000063013/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2020-0212Vendor Advisory
- https://kb.netgear.com/000063013/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2020-0212Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.