Vulnerability Database

289,784

Total vulnerabilities in the database

CVE-2021-27254

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.

  • Published: Mar 5, 2021
  • Updated: Apr 14, 2023
  • CVE: CVE-2021-27254
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 8.8
  • AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 8.3
  • AV:A/AC:L/Au:N/C:C/I:C/A:C

CWEs:

Software From Fixed in
netgear / br200_firmware - 5.10.0.5
netgear / br500_firmware - 5.10.0.5
netgear / d7800_firmware - 1.0.1.60
netgear / ex6100v2_firmware - 1.0.1.98
netgear / ex6150v2_firmware - 1.0.1.98
netgear / ex6250_firmware - 1.0.0.134
netgear / ex6400_firmware - 1.0.2.158
netgear / ex6400v2_firmware - 1.0.0.134
netgear / ex6410_firmware - 1.0.0.134
netgear / ex6420_firmware - 1.0.0.134
netgear / ex7300_firmware - 1.0.2.158
netgear / ex7300v2_firmware - 1.0.0.134
netgear / ex7320_firmware - 1.0.0.134
netgear / ex7700_firmware - 1.0.0.216
netgear / ex8000_firmware - 1.0.1.232
netgear / lbr20_firmware - 2.6.3.50
netgear / r7800_firmware - 1.0.2.80
netgear / r8900_firmware - 1.0.5.28
netgear / r9000_firmware - 1.0.5.28
netgear / rbk12_firmware - 2.7.2.104
netgear / rbk13_firmware - 2.7.2.104
netgear / rbk14_firmware - 2.7.2.104
netgear / rbk15_firmware - 2.7.2.104
netgear / rbk20_firmware - 2.6.2.104
netgear / rbk23_firmware - 2.7.2.104
netgear / rbk40_firmware - 2.6.2.104
netgear / rbk43_firmware - 2.6.2.104
netgear / rbk43s_firmware - 2.6.2.104
netgear / rbk44_firmware - 2.6.2.104
netgear / rbk50_firmware - 2.7.2.104
netgear / rbk53_firmware - 2.7.2.104
netgear / rbr10_firmware - 2.6.2.104
netgear / rbr20_firmware - 2.6.2.104
netgear / rbr40_firmware - 2.6.2.104
netgear / rbr50_firmware - 2.7.2.104
netgear / rbs10_firmware - 2.6.2.104
netgear / rbs20_firmware - 2.6.2.104
netgear / rbs40_firmware - 2.6.2.104
netgear / rbs50_firmware - 2.7.2.104
netgear / rbs50y_firmware - 2.6.2.104
netgear / xr450_firmware - 2.3.2.114
netgear / xr500_firmware - 2.3.2.114
netgear / xr700_firmware - 1.0.1.38