CVE-2021-45620: Command Injection
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, EAX20 before 1.0.0.58, EAX80 before 1.0.1.68, LAX20 before 1.1.6.28, MR60 before 1.0.6.116, MR80 before 1.1.2.20, MS60 before 1.0.6.116, MS80 before 1.1.2.20, MK62 before 1.0.6.116, MK83 before 1.1.2.20, R6400 before 1.0.1.70, R6400v2 before 1.0.4.106, R6700v3 before 1.0.4.106, R6900P before 1.3.3.140, R7000 before 1.0.11.126, R7000P before 1.3.3.140, R7850 before 1.0.5.74, R7900 before 1.0.4.46, R7900P before 1.4.2.84, R7960P before 1.4.2.84, R8000 before 1.0.4.74, R8000P before 1.4.2.84, RAX15 before 1.0.3.96, RAX20 before 1.0.3.96, RAX200 before 1.0.4.120, RAX35v2 before 1.0.3.96, RAX40v2 before 1.0.3.96, RAX43 before 1.0.3.96, RAX45 before 1.0.3.96, RAX50 before 1.0.3.96, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120, RBK752 before 3.2.17.12, RBK852 before 3.2.17.12, RBR750 before 3.2.17.12, RBR850 before 3.2.17.12, RBS750 before 3.2.17.12, RBS850 before 3.2.17.12, RS400 before 1.5.1.80, XR1000 before 1.0.0.58, and XR300 before 1.0.3.68.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-45620?
The severity of CVE-2021-45620 is considered high due to the ability of unauthenticated attackers to perform command injection on affected NETGEAR devices.
How do I fix CVE-2021-45620?
To fix CVE-2021-45620, it is recommended to upgrade the firmware of the affected NETGEAR devices to the latest available version.
Which NETGEAR devices are affected by CVE-2021-45620?
CVE-2021-45620 affects various NETGEAR devices including CBR40, CBR750, EAX20, EAX80, LAX20, MR60, and others.
Can CVE-2021-45620 be exploited remotely?
Yes, CVE-2021-45620 can be exploited remotely by an unauthenticated attacker due to the nature of command injection.
What versions of firmware are vulnerable to CVE-2021-45620?
Firmware versions prior to 2.5.0.24 for CBR40, 4.6.3.6 for CBR750, and various earlier versions for other affected devices are vulnerable to CVE-2021-45620.