First published: Thu Dec 30 2021(Updated: )
Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.
Credit: vulnreport@tenable.com
Affected Software | Affected Version | How to fix |
---|---|---|
Netgear Rax43 Firmware | =1.0.3.96 | |
Netgear RAX43 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2021-20170.
The severity of CVE-2021-20170 is high with a CVSS score of 8.8.
The affected software for CVE-2021-20170 is Netgear RAX43 version 1.0.3.96.
CVE-2021-20170 is a vulnerability in Netgear RAX43 version 1.0.3.96 that makes use of hardcoded credentials.
To fix CVE-2021-20170, it is recommended to update the firmware of the Netgear RAX43 device to a version that does not have the vulnerability.