CVE-2018-21209 : Certain NETGEAR devices are affected by reflected XSS. This affects JNR1010v2 be

Certain NETGEAR devices are affected by reflected XSS. This affects JNR1010v2 before 1.1.0.46, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.46, PR2000 before 1.0.0.20, R6050 before 1.0.1.10, R6220 before 1.1.0.60, WNDR3700v5 before 1.1.0.50, WNR1000v4 before 1.1.0.46, WNR2020 before 1.1.0.46, and WNR2050 before 1.1.0.46.

Published 2020-04-28 16:15:14

Updated 2020-05-04 15:46:03

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2018-21209

Netgear » Wnr1000 Firmware
Versions before (<) 1.1.0.46
cpe:2.3:o:netgear:wnr1000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wnr1000 » Version: V4
Netgear » Jnr1010 Firmware
Versions before (<) 1.1.0.46
cpe:2.3:o:netgear:jnr1010_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Jnr1010 » Version: V2
Netgear » Jr6150 Firmware
Versions before (<) 1.0.1.10
cpe:2.3:o:netgear:jr6150_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Jr6150 » Version: N/A
Netgear » R6050 Firmware
Versions before (<) 1.0.1.10
cpe:2.3:o:netgear:r6050_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6050 » Version: N/A
Netgear » R6220 Firmware
Versions before (<) 1.1.0.60
cpe:2.3:o:netgear:r6220_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R6220 » Version: N/A
Netgear » Wndr3700 Firmware
Versions before (<) 1.1.0.50
cpe:2.3:o:netgear:wndr3700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wndr3700 » Version: V5
Netgear » Jwnr2010 Firmware
Versions before (<) 1.1.0.46
cpe:2.3:o:netgear:jwnr2010_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Jwnr2010 » Version: V5
Netgear » Wnr2020 Firmware
Versions before (<) 1.1.0.46
cpe:2.3:o:netgear:wnr2020_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wnr2020 » Version: N/A
Netgear » Pr2000 Firmware
Versions before (<) 1.0.0.20
cpe:2.3:o:netgear:pr2000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Pr2000 » Version: N/A
Netgear » Wnr2050 Firmware
Versions before (<) 1.1.0.46
cpe:2.3:o:netgear:wnr2050_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Wnr2050 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-21209

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 46 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-21209

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.5	LOW	AV:N/AC:M/Au:S/C:N/I:P/A:N	6.8	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.8	MEDIUM	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	1.7	2.7	MITRE
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: None
4.8	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	1.7	2.7	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2018-21209

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-21209

https://kb.netgear.com/000055140/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Routers-and-Extenders-PSV-2017-2514

Security Advisory for Reflected Cross-Site Scripting on Some Routers and Extenders, PSV-2017-2514 | Answer | NETGEAR Support
Vendor Advisory

Jump to

Vulnerability Details : CVE-2018-21209

Products affected by CVE-2018-21209

Exploit prediction scoring system (EPSS) score for CVE-2018-21209

CVSS scores for CVE-2018-21209

CWE ids for CVE-2018-21209

References for CVE-2018-21209