CVE-2021-27254 : This vulnerability allows network-adjacent attackers to bypass authentication on

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.

Published 2021-03-05 20:15:12

Updated 2022-04-25 17:48:00

Source Zero Day Initiative

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2021-27254

Netgear » R7800 Firmware
Versions before (<) 1.0.2.80
cpe:2.3:o:netgear:r7800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R7800 » Version: N/A
Netgear » R9000 Firmware
Versions before (<) 1.0.5.28
cpe:2.3:o:netgear:r9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R9000 » Version: N/A
Netgear » D7800 Firmware
Versions before (<) 1.0.1.60
cpe:2.3:o:netgear:d7800_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » D7800 » Version: N/A
Netgear » Ex6400 Firmware
Versions before (<) 1.0.2.158
cpe:2.3:o:netgear:ex6400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6400 » Version: N/A
Netgear » Ex7300 Firmware
Versions before (<) 1.0.2.158
cpe:2.3:o:netgear:ex7300_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex7300 » Version: N/A
Netgear » Ex8000 Firmware
Versions before (<) 1.0.1.232
cpe:2.3:o:netgear:ex8000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex8000 » Version: N/A
Netgear » R8900 Firmware
Versions before (<) 1.0.5.28
cpe:2.3:o:netgear:r8900_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » R8900 » Version: N/A
Netgear » Xr500 Firmware
Versions before (<) 2.3.2.114
cpe:2.3:o:netgear:xr500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Xr500 » Version: N/A
Netgear » Xr700 Firmware
Versions before (<) 1.0.1.38
cpe:2.3:o:netgear:xr700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Xr700 » Version: N/A
Netgear » Rbr20 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbr20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr20 » Version: N/A
Netgear » Rbs20 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbs20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs20 » Version: N/A
Netgear » Rbk20 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbk20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk20 » Version: N/A
Netgear » Rbr40 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbr40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr40 » Version: N/A
Netgear » Rbs40 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbs40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs40 » Version: N/A
Netgear » Rbk40 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbk40_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk40 » Version: N/A
Netgear » Rbr50 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbr50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr50 » Version: N/A
Netgear » Rbs50 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbs50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs50 » Version: N/A
Netgear » Rbk50 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbk50_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk50 » Version: N/A
Netgear » Xr450 Firmware
Versions before (<) 2.3.2.114
cpe:2.3:o:netgear:xr450_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Xr450 » Version: N/A
Netgear » Br200 Firmware
Versions before (<) 5.10.0.5
cpe:2.3:o:netgear:br200_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Br200 » Version: N/A
Netgear » Br500 Firmware
Versions before (<) 5.10.0.5
cpe:2.3:o:netgear:br500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Br500 » Version: N/A
Netgear » Ex6100v2 Firmware
Versions before (<) 1.0.1.98
cpe:2.3:o:netgear:ex6100v2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6100v2 » Version: N/A
Netgear » Ex6150v2 Firmware
Versions before (<) 1.0.1.98
cpe:2.3:o:netgear:ex6150v2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6150v2 » Version: N/A
Netgear » Ex6250 Firmware
Versions before (<) 1.0.0.134
cpe:2.3:o:netgear:ex6250_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6250 » Version: N/A
Netgear » Ex6400v2 Firmware
Versions before (<) 1.0.0.134
cpe:2.3:o:netgear:ex6400v2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6400v2 » Version: N/A
Netgear » Ex6410 Firmware
Versions before (<) 1.0.0.134
cpe:2.3:o:netgear:ex6410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6410 » Version: N/A
Netgear » Ex6420 Firmware
Versions before (<) 1.0.0.134
cpe:2.3:o:netgear:ex6420_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex6420 » Version: N/A
Netgear » Ex7300v2 Firmware
Versions before (<) 1.0.0.134
cpe:2.3:o:netgear:ex7300v2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex7300v2 » Version: N/A
Netgear » Ex7320 Firmware
Versions before (<) 1.0.0.134
cpe:2.3:o:netgear:ex7320_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex7320 » Version: N/A
Netgear » Ex7700 Firmware
Versions before (<) 1.0.0.216
cpe:2.3:o:netgear:ex7700_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Ex7700 » Version: N/A
Netgear » Lbr20 Firmware
Versions before (<) 2.6.3.50
cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Lbr20 » Version: N/A
Netgear » Rbk12 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbk12_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk12 » Version: N/A
Netgear » Rbk13 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbk13_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk13 » Version: N/A
Netgear » Rbk14 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbk14_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk14 » Version: N/A
Netgear » Rbk15 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbk15_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk15 » Version: N/A
Netgear » Rbk23 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbk23_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk23 » Version: N/A
Netgear » Rbk43 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbk43_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk43 » Version: N/A
Netgear » Rbk43s Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbk43s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk43s » Version: N/A
Netgear » Rbk44 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbk44_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk44 » Version: N/A
Netgear » Rbk53 Firmware
Versions before (<) 2.7.2.104
cpe:2.3:o:netgear:rbk53_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbk53 » Version: N/A
Netgear » Rbr10 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbr10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbr10 » Version: N/A
Netgear » Rbs10 Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbs10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs10 » Version: N/A
Netgear » Rbs50y Firmware
Versions before (<) 2.6.2.104
cpe:2.3:o:netgear:rbs50y_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Netgear » Rbs50y » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-27254

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-27254

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.3	HIGH	AV:A/AC:L/Au:N/C:C/I:C/A:C	6.5	10.0	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.3	MEDIUM	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	2.8	3.4	Zero Day Initiative
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: Low
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-27254

CWE-259 Use of Hard-coded Password

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Assigned by: zdi-disclosures@trendmicro.com (Secondary)
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-27254

https://www.zerodayinitiative.com/advisories/ZDI-21-252/

ZDI-21-252 | Zero Day Initiative
Third Party Advisory;VDB Entry
https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders

Security Advisory for Multiple Vulnerabilities on Some Routers, Satellites, and Extenders | Answer | NETGEAR Support
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-27254

Products affected by CVE-2021-27254

Exploit prediction scoring system (EPSS) score for CVE-2021-27254

CVSS scores for CVE-2021-27254

CWE ids for CVE-2021-27254

References for CVE-2021-27254