CVE-2021-27254CWE-259

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800

Medium · published March 5, 2021

CVSS v3.0
6.3
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.

The record
Technical detail
CVSS v3.0
6.3 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.1th percentile
Weakness
CWE-259 · Use of Hard-coded Password
Published
2021-03-05T20:00Z
EPSS history
Timeline
  • 05 MAR 20:00Z
    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800
    cvelistv5