First published: Mon Mar 29 2021(Updated: )
This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the MibController class. When parsing the realName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12122.
Credit: zdi-disclosures@trendmicro.com
Affected Software | Affected Version | How to fix |
---|---|---|
NETGEAR ProSAFE Network Management System | =1.6.0.26 | |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2021-27276 is a vulnerability in NETGEAR ProSAFE Network Management System that allows remote attackers to delete arbitrary files and bypass authentication.
The severity of CVE-2021-27276 is high, with a score of 7.1.
This vulnerability can be exploited remotely by deleting arbitrary files and bypassing authentication.
NETGEAR ProSAFE Network Management System version 1.6.0.26 is specifically affected.
Yes, NETGEAR has released a security advisory with a fix for this vulnerability.