CVE-2021-45673 — Cross-site Scripting in Netgear R6900p Firmware

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
CNA4.8
EPSS
0.2%
top 58.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Netgear R6900p FirmwareNetgear R7000 FirmwareNetgear R7000p Firmware+5 more
Timeline
PublishedDec 26
Latest updateDec 27

Description

Certain NETGEAR devices are affected by stored XSS. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62, RAX200 before 1.0.3.106, R7000P before 1.3.3.140, RAX80 before 1.0.3.106, R6900P before 1.3.3.140, and RAX75 before 1.0.3.106.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages8 packages

▶NVDnetgear/r7000p_firmware< 1.3.3.140
▶NVDnetgear/r7000_firmware< 1.0.11.110
▶NVDnetgear/r7900_firmware< 1.0.4.30
▶NVDnetgear/r8000_firmware< 1.0.4.62
▶NVDnetgear/rax75_firmware< 1.0.3.106

Patches

Patch: kb.netgear.com ↗Patch: kb.netgear.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8wfx-77v8-mc24: Certain NETGEAR devices are affected by stored XSS↗2021-12-27
▶
CVEList
CVE-2021-45673: Certain NETGEAR devices are affected by stored XSS↗2021-12-26
▶
CVE-2021-45673 — Cross-site Scripting in Netgear | cvebase