Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-40866

Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default) /sqfs/bin/sccd daemon, which fails to check authentication when the authentication TLV is missing from a received NSDP packet. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.

Published

2021-09-13T08:15:08.037

Last Modified

2024-11-21T06:24:58.243

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:A/AC:M/Au:N/C:P/I:P/A:P

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

5.5

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System netgear gc108p_firmware < 1.0.8.2 Yes
Hardware netgear gc108p - No
Operating System netgear gc108pp_firmware < 1.0.8.2 Yes
Hardware netgear gc108pp - No
Operating System netgear gs108t_firmware < 7.0.7.2 Yes
Hardware netgear gs108tv3 - No
Operating System netgear gs110tpp_firmware < 7.0.7.2 Yes
Hardware netgear gs110tpp - No
Operating System netgear gs110tp_firmware < 7.0.7.2 Yes
Hardware netgear gs110tp v3 No
Operating System netgear gs110tup_firmware < 1.0.5.3 Yes
Hardware netgear gs110tup - No
Operating System netgear gs308t_firmware < 1.0.3.2 Yes
Hardware netgear gs308t - No
Operating System netgear gs310tp_firmware < 1.0.3.2 Yes
Hardware netgear gs310tp - No
Operating System netgear gs710tup_firmware < 1.0.5.3 Yes
Hardware netgear gs710tup - No
Operating System netgear gs716tp_firmware < 1.0.4.2 Yes
Hardware netgear gs716tp - No
Operating System netgear gs716tpp_firmware < 1.0.4.2 Yes
Hardware netgear gs716tpp - No
Operating System netgear gs724tpp_firmware < 2.0.6.3 Yes
Hardware netgear gs724tpp - No
Operating System netgear gs724tp_firmware < 2.0.6.3 Yes
Hardware netgear gs724tp v2 No
Operating System netgear gs728tpp_firmware < 6.0.8.2 Yes
Hardware netgear gs728tpp v2 No
Operating System netgear gs728tp_firmware < 6.0.8.2 Yes
Hardware netgear gs728tp v2 No
Operating System netgear gs750e_firmware < 1.0.1.10 Yes
Hardware netgear gs750e - No
Operating System netgear gs752tpp_firmware < 6.0.8.2 Yes
Hardware netgear gs752tpp - No
Operating System netgear gs752tp_firmware < 6.0.8.2 Yes
Hardware netgear gs752tp v2 No
Operating System netgear ms510txm_firmware < 1.0.4.2 Yes
Hardware netgear ms510txm - No
Operating System netgear ms510txup_firmware < 1.0.4.2 Yes
Hardware netgear ms510txup - No
References