CVE-2021-40867

CWE-290CWE-287 — Improper Authentication3 documents3 sources
Severity
7.1HIGH
EPSS
0.2%
top 62.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Netgear Gc108p FirmwareNetgear Gc108pp FirmwareNetgear Gs108t Firmware+17 more
Timeline
PublishedSep 13
Latest updateMay 24

Description

Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an admin in the process of logging in (e.g., behind the same NAT device, or already in possession of a foothold on an admin's machine). This occurs because the multi-step HTTP authentication process is effectively tied only to the source IP address. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages20 packages

▶NVDnetgear/gs750e_firmware< 1.0.1.10

🔴Vulnerability Details

2
GHSA
GHSA-cj95-hc8g-66rx: Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the sa↗2022-05-24
▶
CVEList
CVE-2021-40867: Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the sa↗2021-09-13
▶
CVE-2021-40867 (HIGH CVSS 7.1) | Certain NETGEAR smart switches are | cvebase.io