CVE-2021-45620

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker

Critical · published December 26, 2021

CVSS v3.1
9.6
EPSS
2%
Percentile
80.8
In the wild
Unconfirmed
What it is

🚨 A sneaky command injection lurks in several NETGEAR devices, leaving the door wide open for a remote attacker to take control! 🔥 Think of it like an open service window at a restaurant where anyone can walk up and place orders without being checked — if they know what to say, they can get anything they want! An unauthenticated attacker could execute arbitrary commands on your device. This means they could modify settings, access your network, or even launch further attacks from your equipment — a scenario that's absolutely devastating for your home or business security!

Put simply

Think of it like an open service window at a restaurant where anyone can walk up and place orders without being checked — if they know what to say, they can get anything they want! This vulnerability allows attackers to inject malicious commands into the system via specific input fields, exposing affected NETGEAR devices to unauthorized access and control.

What to do

An unauthenticated attacker could execute arbitrary commands on your device. This means they could modify settings, access your network, or even launch further attacks from your equipment — a scenario that's absolutely devastating for your home or business security! Update your NETGEAR devices immediately to the latest firmware versions: CBR40 (2.5.0.24), CBR750 (4.6.3.6), and others as listed in the CVE details. Regularly check for firmware updates and enable any security features available. 🛡️ You've got this! By following these steps, you'll be one step closer to securing your network like a pro! 💪✨

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.02020 · 80.8th percentile
Published
2021-12-26T00:35Z
EPSS history
Timeline
  • 26 DEC 00:35Z
    Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
    cvelistv5