CVE-2021-27276: NETGEAR ProSAFE Network Management System MibController realName Directory Traversal Denial-of-Service Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the MibController class. When parsing the realName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12122.
Other sources
This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the MibController class. When parsing the realName parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-27276?
CVE-2021-27276 is a vulnerability in NETGEAR ProSAFE Network Management System that allows remote attackers to delete arbitrary files and bypass authentication.
What is the severity of CVE-2021-27276?
The severity of CVE-2021-27276 is high, with a score of 7.1.
How can this vulnerability be exploited?
This vulnerability can be exploited remotely by deleting arbitrary files and bypassing authentication.
What software versions are affected by CVE-2021-27276?
NETGEAR ProSAFE Network Management System version 1.6.0.26 is specifically affected.
Is there a fix available for CVE-2021-27276?
Yes, NETGEAR has released a security advisory with a fix for this vulnerability.