Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-41314

Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.

Published

2021-09-16T22:15:08.257

Last Modified

2024-11-21T06:26:02.167

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

6.5

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-74
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System netgear gc108p_firmware < 1.0.8.2 Yes
Hardware netgear gc108p - No
Operating System netgear gc108pp_firmware < 1.0.8.2 Yes
Hardware netgear gc108pp - No
Operating System netgear gs108t_firmware < 7.0.7.2 Yes
Hardware netgear gs108tv3 - No
Operating System netgear gs110tpp_firmware < 7.0.7.2 Yes
Hardware netgear gs110tpp - No
Operating System netgear gs110tp_firmware < 7.0.7.2 Yes
Hardware netgear gs110tp v3 No
Operating System netgear gs110tup_firmware < 1.0.5.3 Yes
Hardware netgear gs110tup - No
Operating System netgear gs308t_firmware < 1.0.3.2 Yes
Hardware netgear gs308t - No
Operating System netgear gs310tp_firmware < 1.0.3.2 Yes
Hardware netgear gs310tp - No
Operating System netgear gs710tup_firmware < 1.0.5.3 Yes
Hardware netgear gs710tup - No
Operating System netgear gs716tp_firmware < 1.0.4.2 Yes
Hardware netgear gs716tp - No
Operating System netgear gs716tpp_firmware < 1.0.4.2 Yes
Hardware netgear gs716tpp - No
Operating System netgear gs724tpp_firmware < 2.0.6.3 Yes
Hardware netgear gs724tpp - No
Operating System netgear gs724tp_firmware < 2.0.6.3 Yes
Hardware netgear gs724tp v2 No
Operating System netgear gs728tpp_firmware < 2.0.6.3 Yes
Hardware netgear gs728tpp v2 No
Operating System netgear gs728tp_firmware < 2.0.6.3 Yes
Hardware netgear gs728tp v2 No
Operating System netgear gs750e_firmware < 1.0.1.10 Yes
Hardware netgear gs750e - No
Operating System netgear gs752tpp_firmware < 6.0.8.2 Yes
Hardware netgear gs752tpp - No
Operating System netgear gs752tp_firmware < 6.0.8.2 Yes
Hardware netgear gs752tp v2 No
Operating System netgear ms510txm_firmware < 1.0.4.2 Yes
Hardware netgear ms510txm - No
Operating System netgear ms510txup_firmware < 1.0.4.2 Yes
Hardware netgear ms510txup - No
References