CVE-2021-20170
First published: Thu Dec 30 2021(Updated: )
Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Netgear Rax43 Firmware | =1.0.3.96 | |
| Netgear RAX43 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-20170.
What is the severity of CVE-2021-20170?
The severity of CVE-2021-20170 is high with a CVSS score of 8.8.
What is the affected software for CVE-2021-20170?
The affected software for CVE-2021-20170 is Netgear RAX43 version 1.0.3.96.
What is the vulnerability description of CVE-2021-20170?
CVE-2021-20170 is a vulnerability in Netgear RAX43 version 1.0.3.96 that makes use of hardcoded credentials.
How do I fix CVE-2021-20170?
To fix CVE-2021-20170, it is recommended to update the firmware of the Netgear RAX43 device to a version that does not have the vulnerability.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/netgear
- canonical/netgear rax43 firmware
- version/netgear rax43 firmware/1.0.3.96
- canonical/netgear rax43