CVE-2021-20168

CWE-287 — Improper AuthenticationCWE-522 — Insufficiently Protected Credentials3 documents3 sources
Severity
6.8MEDIUM
EPSS
0.1%
top 84.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Netgear Rax43 Firmware
Timeline
PublishedDec 30
Latest updateDec 31

Description

Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection, login with default credentials, and execute commands as the root user. These default credentials are admin:admin.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 0.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5netgear_rax431.0.3.96

🔴Vulnerability Details

2
GHSA
GHSA-xvmx-9r4c-crmv: Netgear RAX43 version 1↗2021-12-31
▶
CVEList
CVE-2021-20168: Netgear RAX43 version 1↗2021-12-30
▶
CVE-2021-20168 (MEDIUM CVSS 6.8) | Netgear RAX43 version 1.0.3.96 does | cvebase.io