CVE-2021-20166
published 2021-12-30CVE-2021-20166: Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer…
PriorityP276high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.20%
80.4th percentile
Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | rax43_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/cgi-bin/readycloud_control.cgi?1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111/api/users↗
- →Detect exploitation attempts by monitoring POST requests to /cgi-bin/readycloud_control.cgi with an abnormally long query string (256+ repeated characters) followed by /api/users, indicative of the buffer overrun trigger. ↗
- →Detect command injection payloads in the 'name' parameter of requests to readycloud_control.cgi; look for shell metacharacters such as single quotes and $() subshell syntax. ↗
- →Monitor for outbound curl-based HTTP callbacks (User-Agent: curl) originating from the router, which may indicate successful command injection via the name parameter. ↗
- →The vulnerability is exploitable from the adjacent network (AV:A) by a low-privileged authenticated user; monitor for unexpected authenticated POST requests to the readycloud_control.cgi endpoint from LAN-side clients. ↗
- ·This detection template covers a combined exploit chain using both CVE-2021-20166 (buffer overrun in URL parsing of cgi-bin) and CVE-2021-20167 (command injection in name parameter); detections should account for both components being used together. ↗
- ·The buffer overrun is triggered specifically by a query string of 256 repeated '1' characters in the URL before /api/users; detection rules should match this specific pattern length to reduce false positives. ↗
- ·Affected firmware is specifically Netgear RAX43 version 1.0.3.96; detections and mitigations should be scoped to this firmware version. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.05.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:P
vulncheck8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-756v-gg77-ccw5: Netgear RAX43 version 1
ghsa_unreviewed·2021-12-31
CVE-2021-20166 [HIGH] CWE-120 GHSA-756v-gg77-ccw5: Netgear RAX43 version 1
Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton.
VulnCheck
NETGEAR rax43 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
vulncheck·2021·CVSS 8.8
CVE-2021-20166 [HIGH] NETGEAR rax43 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
NETGEAR rax43 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton.
Affected: NETGEAR rax43
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-20166; https://dashboard.shadowserver.org/statistics/honeypot/vulnerabilit
No detection rules found.
Nuclei
Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun
nuclei·CVSS 8.8
CVE-2021-20167 [HIGH] Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun
Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun
Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerability. The readycloud_control.cgi CGI application is vulnerable to command injection in the name parameter. Additionally, the URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the application. Note: This vulnerability uses a combination of CVE-2021-20166 and CVE-2021-20167.
Template:
id: CVE-2021-20167
info:
name: Netgear RAX43 1.0.3.96 - Command Injection/Authentication Bypass Buffer Overrun
author: gy741
severity: high
description: 'Netgear RAX43 version 1.0.3.96 contains a command injection and authentication bypass vulnerabilit
Unit42
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
blogs_unit42·2022-08-19·CVSS 8.8
CVE-2021-20166 [HIGH] Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
Yue Guan
Published: August 19, 2022
Trend Reports
Vulnerabilities
Attack analysis
CVE-2021-20166
CVE-2021-20167
CVE-2021-21881
CVE-2021-24762
CVE-2021-28169
CVE-2021-31589
CVE-2021-39226
CVE-2021-4045
CVE-2021-43711
CVE-2022-21371
CVE-2022-21662
CVE-2022-22536
CVE-2022-22947
CVE-2022-22954
CVE-2022-22963
CVE-2022-22965
CVE-2022-24112
CVE-2022-24260
CVE-2022-25060
CVE-2022-25075
CVE-2022-25134
CVE-2022-27226
CVE-2022-29464
Exploit in the wild
Network security trends
## Executive Summary
Recent observations of exploits used in the wild reveal that attackers have been making use
Unit42
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
blogs_unit42·2022-08-19
Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More
## Executive Summary
Recent observations of exploits used in the wild reveal that attackers have been making use of newly published remote code execution vulnerabilities in VMware ONE Access and Identity Manager and Spring Cloud Function, Spring MVC and Spring Web Flux, among others. Attackers have also been taking advantage of a cross-site scripting vulnerability in WordPress core, and SQL injection vulnerabilities in VoIPmonitor GUI and other services. In our observations of network security trends, Unit 42 researchers select exploits of the latest published attacks that defenders should know based on the availability of proofs of concept (PoCs), the severity of the vulnerabilities the exploits are based on and the ease of exploitation.
Other insights that could assist defenders includ
Tenable
Netgear Nighthawk RAX43 Multiple Vulnerabilities
blogs_tenable·2021-12-30
Netgear Nighthawk RAX43 Multiple Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
NoiseLetter
blogs_greynoiseio
NoiseLetter
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
2021-12-30
Published
Exploited in the wild