CVE-2021-45674 — Cross-site Scripting in Netgear R7000 Firmware

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
4.8MEDIUMNVD
CNA3.2
EPSS
0.3%
top 49.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Netgear R7000 FirmwareNetgear R7900 FirmwareNetgear R8000 Firmware+5 more
Timeline
PublishedDec 26
Latest updateDec 27

Description

Certain NETGEAR devices are affected by stored XSS. This affects R7000 before 1.0.11.110, R7900 before 1.0.4.30, R8000 before 1.0.4.62, RAX15 before 1.0.2.82, RAX20 before 1.0.2.82, RAX200 before 1.0.3.106, RAX75 before 1.0.3.106, and RAX80 before 1.0.3.106.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages8 packages

▶NVDnetgear/rax200_firmware< 1.0.3.106
▶NVDnetgear/r7000_firmware< 1.0.11.110
▶NVDnetgear/r7900_firmware< 1.0.4.30
▶NVDnetgear/r8000_firmware< 1.0.4.62
▶NVDnetgear/rax15_firmware< 1.0.2.82

Patches

Patch: kb.netgear.com ↗Patch: kb.netgear.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-qgf2-89wq-3xhc: Certain NETGEAR devices are affected by stored XSS↗2021-12-27
▶
CVEList
CVE-2021-45674: Certain NETGEAR devices are affected by stored XSS↗2021-12-26
▶
CVE-2021-45674 — Cross-site Scripting in Netgear | cvebase