CVE-2021-45618

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker

Critical · published December 26, 2021

CVSS v3.1
9.6
EPSS
2%
Percentile
80.8
In the wild
Unconfirmed
What it is

🚨 Unauthenticated attackers can execute ANY command on certain NETGEAR devices, turning your home network into a playground for malicious activity! 🔥 Think of it like leaving the back door of your house wide open while casually inviting strangers for a dinner party. You're just asking for trouble! An attacker could take control of your device, access sensitive data, or even compromise your entire network. This vulnerability is absolutely devastating for any user, as it allows full control without any authentication whatsoever, paving the way for data breaches and unauthorized access.

Put simply

Think of it like leaving the back door of your house wide open while casually inviting strangers for a dinner party. You're just asking for trouble! This command injection vulnerability in NETGEAR devices allows unauthenticated attackers to execute arbitrary commands, bypassing normal security mechanisms. It affects a range of models, including D7800 and RAX120, all before specified versions.

What to do

An attacker could take control of your device, access sensitive data, or even compromise your entire network. This vulnerability is absolutely devastating for any user, as it allows full control without any authentication whatsoever, paving the way for data breaches and unauthorized access. Update your NETGEAR devices immediately to the latest firmware versions: D7800 to 1.0.1.64 or higher, RAX120 to 1.2.0.16, and others as listed in CVE-2021-45618. It's essential to regularly check for updates and ensure your devices are always secure. You've got this! By patching and staying updated, you're on your way to becoming a security hero! 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.02020 · 80.8th percentile
Published
2021-12-26T00:35Z
EPSS history
Timeline
  • 26 DEC 00:35Z
    Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
    cvelistv5