cbcvebase.
CVE-2021-41314
published 2021-09-16

CVE-2021-41314: Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication…

PriorityP261high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
13.62%
96.0th percentile
Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.

Affected

20 ranges
VendorProductVersion rangeFixed in
netgeargc108p_firmware< 1.0.8.21.0.8.2
netgeargc108pp_firmware< 1.0.8.21.0.8.2
netgeargs108t_firmware< 7.0.7.27.0.7.2
netgeargs110tp_firmware< 7.0.7.27.0.7.2
netgeargs110tpp_firmware< 7.0.7.27.0.7.2
netgeargs110tup_firmware< 1.0.5.31.0.5.3
netgeargs308t_firmware< 1.0.3.21.0.3.2
netgeargs310tp_firmware< 1.0.3.21.0.3.2
netgeargs710tup_firmware< 1.0.5.31.0.5.3
netgeargs716tp_firmware< 1.0.4.21.0.4.2
netgeargs716tpp_firmware< 1.0.4.21.0.4.2
netgeargs724tp_firmware< 2.0.6.32.0.6.3
netgeargs724tpp_firmware< 2.0.6.32.0.6.3
netgeargs728tp_firmware< 2.0.6.32.0.6.3
netgeargs728tpp_firmware< 2.0.6.32.0.6.3
netgeargs750e_firmware< 1.0.1.101.0.1.10
netgeargs752tp_firmware< 6.0.8.26.0.8.2
netgeargs752tpp_firmware< 6.0.8.26.0.8.2
netgearms510txm_firmware< 1.0.4.21.0.4.2
netgearms510txup_firmware< 1.0.4.21.0.4.2

Detection & IOCsextracted from sources · hover to see the quote

url/cgi/set.cgi?cmd=home_loginAuth
path/cgi/set.cgi
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Netgear Seventh Inferno CVE-2021-41314 (new line injection)"; http.method; content:"POST"; http.uri; content:"/cgi/set.cgi?cmd=home_loginAuth"; fast_pattern; http.request_body; content:"_ds="; content:"pwd="; distance:0; pcre:"/^[^&\x0d\r]+[\n\x0a]/R"; reference:url,gynvael.coldwind.pl/?id=742; reference:cve,2021-41314; classtype:attempted-dos; sid:2033969; rev:2; metadata:attack_target Networking_Equipment, created_at 2021_09_16, cve CVE_2021_41314, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_09_16;)
  • →Attack targets HTTP POST requests to /cgi/set.cgi?cmd=home_loginAuth; look for a newline character (\n or \x0a) injected within the `pwd=` parameter of the request body, which is the core of the \n injection exploit.
  • →The exploit allows an unauthenticated attacker to craft an admin session by writing a file with specific content (e.g., the "2" string) via the newline injection in the password field of the web UI login. ↗
  • →The Emerging Threats rule (SID 2033969) with fast_pattern on the URI string /cgi/set.cgi?cmd=home_loginAuth can be used for perimeter detection of exploitation attempts against NETGEAR smart switches.
  • ·The vulnerability affects multiple NETGEAR smart switch models across several firmware branches; ensure version checks are applied per-model (e.g., GC108P before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS750E before 1.0.1.10, MS510TXM before 1.0.4.2, etc.) as a single firmware version threshold does not apply universally. ↗
  • ·The Snort/Suricata rule (SID 2033969, rev:2) is classified as `attempted-dos` but the actual impact is unauthenticated admin session takeover — defenders should treat alerts as high-severity authentication bypass attempts, not just DoS.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.3HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.