VulnerabilityModified

CVE-2021-45674

Certain NETGEAR devices are affected by stored XSS.

MEDIUM 4.8EPSS 0.42%

Does this matter?

Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.

Description

Certain NETGEAR devices are affected by stored XSS. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62, RAX15 before 1.0.2.82, RAX20 before 1.0.2.82, RAX200 before 1.0.3.106, RAX75 before 1.0.3.106, and RAX80 before 1.0.3.106.

CVSS 3.1: 4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.42% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: netgear/r7000 firmware · netgear/r7900 firmware · netgear/r8000 firmware · netgear/rax15 firmware · netgear/rax20 firmware · netgear/rax200 firmware · netgear/rax75 firmware · netgear/rax80 firmware
Source: cve@mitre.org

References

https://kb.netgear.com/000064077/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2020-0017Patch, Vendor Advisory
https://kb.netgear.com/000064077/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2020-0017Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.