VulnerabilityModified

CVE-2021-45613

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.

CRITICAL 9.8EPSS 2.02%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, D7000v2 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, MR80 before 1.1.2.20, MS80 before 1.1.2.20, RAX15 before 1.0.3.96, RAX20 before 1.0.3.96, RAX200 before 1.0.4.120, RAX45 before 1.0.3.96, RAX50 before 1.0.3.96, RAX43 before 1.0.3.96, RAX40v2 before 1.0.3.96, RAX35v2 before 1.0.3.96, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, and XR1000 before 1.0.0.58.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 2.02% probability · 80th percentile
CISA KEV: Not listed
Weakness: CWE-77
Affected: netgear/cbr40 firmware · netgear/cbr750 firmware · netgear/d7000v2 firmware · netgear/lax20 firmware · netgear/mk62 firmware · netgear/mr60 firmware · netgear/ms60 firmware · netgear/rax15 firmware · netgear/rax20 firmware · netgear/rax200 firmware · netgear/rax35v2 firmware · netgear/rax40v2 firmware · netgear/rax43 firmware · netgear/rax45 firmware · netgear/rax50 firmware · netgear/rax75 firmware · netgear/rax80 firmware · netgear/rbk752 firmware · netgear/rbk852 firmware · netgear/rbr750 firmware · +6 more
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.