CVE-2021-45556
Certain NETGEAR devices are affected by command injection by an authenticated user.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects GS108Tv2 before 5.4.2.36, GS110TPP before 7.0.7.2, GS110TPv2 before 5.4.2.36., GS110TPv3 before 7.0.7.2, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.22% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- netgear/gs108tv2 firmware · netgear/gs110tpp firmware · netgear/gs110tpv2 firmware · netgear/gs308t firmware · netgear/gs110tpv3 firmware · netgear/gs310tp firmware · netgear/gs724tpp firmware · netgear/gs724tpv2 firmware · netgear/gs728tppv2 firmware · netgear/gs728tpv2 firmware · netgear/gs752tpp firmware · netgear/gs752tpv2 firmware · netgear/ms510txm firmware · netgear/ms510txup firmware
- Source
- cve@mitre.org
References
- https://kb.netgear.com/000064534/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Smart-Managed-Pro-Switches-PSV-2021-0175Patch, Vendor Advisory
- https://kb.netgear.com/000064534/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Smart-Managed-Pro-Switches-PSV-2021-0175Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.