CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2021-38530

CVSS 9.6v3.1pub. 2021-08-11upd. 2024-11-21

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2.5.1.16, RBR20 before 2.5.1.16, RBS20 before 2.5.1.16, RBK50 before 2.5.1.16, RBR50 before 2.5.1.16, RBS50 before 2.5.1.16, and RBS50Y before 2.6.1.40.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Netgear Rbk20

    HW
    Netgear
    all versions

  • Netgear Rbk20 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbk40

    HW
    Netgear
    all versions

  • Netgear Rbk40 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbk50

    HW
    Netgear
    all versions

  • Netgear Rbk50 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbr20

    HW
    Netgear
    all versions

  • Netgear Rbr20 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbr40

    HW
    Netgear
    all versions

  • Netgear Rbr40 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbr50

    HW
    Netgear
    all versions

  • Netgear Rbr50 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbs20

    HW
    Netgear
    all versions

  • Netgear Rbs20 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbs40

    HW
    Netgear
    all versions

  • Netgear Rbs40 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbs50

    HW
    Netgear
    all versions

  • Netgear Rbs50 Firmware

    OS
    Netgear
    < 2.5.1.16

  • Netgear Rbs50y

    HW
    Netgear
    all versions

  • Netgear Rbs50y Firmware

    OS
    Netgear
    < 2.6.1.40
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2021-45626CRITICAL9.6PL ✓same product

Command injection bez uwierzytelnienia w urządzeniach NETGEAR Orbi

CVE-2021-45619CRITICAL9.6PL ✓same product

NETGEAR — command injection bez uwierzytelnienia w routerach i extenderach

CVE-2021-45618CRITICAL9.6PL ✓same product

NETGEAR — unauthenticated command injection w routerach i extenderach

CVE-2021-38516CRITICAL10.0PL ✓same product

Brak kontroli dostępu na poziomie funkcji w urządzeniach NETGEAR

CVE-2022-40619HIGH7.7same product

FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server ...