VulnerabilityModified

CVE-2021-45499

Certain NETGEAR devices are affected by authentication bypass.

HIGH 8.8EPSS 0.98%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.98%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Certain NETGEAR devices are affected by authentication bypass. This affects R6900P before 1.3.3.140, R7000P before 1.3.3.140, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000P before 1.4.2.84, RAX75 before 1.0.3.106, and RAX80 before 1.0.3.106.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.98% probability · 60th percentile
CISA KEV: Not listed
Affected: netgear/r6900p firmware · netgear/r7000p firmware · netgear/r7900p firmware · netgear/r7960p firmware · netgear/r8000p firmware · netgear/rax75 firmware · netgear/rax80 firmware
Source: cve@mitre.org

References

https://kb.netgear.com/000064445/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2019-0027Patch, Vendor Advisory
https://kb.netgear.com/000064445/Security-Advisory-for-Authentication-Bypass-on-Some-Routers-PSV-2019-0027Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.