CVE Feed

    Dashboard / CVE / CVE-2021-27257

    CVE-2021-27257

    This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via FTP. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-12362.

    Published:Mar 5, 2021
    Last Modified:Nov 21, 2024
    EPS:Mar 5, 2021
    EPSS Score:0.00057
    CVSS Score:6.5

    Affected Products

    Vendor
    Netgear
    Product
    Br200
    Vendor
    Netgear
    Product
    Br200 Firmware
    Vendor
    Netgear
    Product
    Br500
    Vendor
    Netgear
    Product
    Br500 Firmware
    Vendor
    Netgear
    Product
    D7800
    Vendor
    Netgear
    Product
    D7800 Firmware
    Vendor
    Netgear
    Product
    Ex6100v2
    Vendor
    Netgear
    Product
    Ex6100v2 Firmware
    Vendor
    Netgear
    Product
    Ex6150v2
    Vendor
    Netgear
    Product
    Ex6150v2 Firmware
    Vendor
    Netgear
    Product
    Ex6250
    Vendor
    Netgear
    Product
    Ex6250 Firmware
    Vendor
    Netgear
    Product
    Ex6400
    Vendor
    Netgear
    Product
    Ex6400 Firmware
    Vendor
    Netgear
    Product
    Ex6400v2
    Vendor
    Netgear
    Product
    Ex6400v2 Firmware
    Vendor
    Netgear
    Product
    Ex6410
    Vendor
    Netgear
    Product
    Ex6410 Firmware
    Vendor
    Netgear
    Product
    Ex6420
    Vendor
    Netgear
    Product
    Ex6420 Firmware
    Vendor
    Netgear
    Product
    Ex7300
    Vendor
    Netgear
    Product
    Ex7300 Firmware
    Vendor
    Netgear
    Product
    Ex7300v2
    Vendor
    Netgear
    Product
    Ex7300v2 Firmware
    Vendor
    Netgear
    Product
    Ex7320
    Vendor
    Netgear
    Product
    Ex7320 Firmware
    Vendor
    Netgear
    Product
    Ex7700
    Vendor
    Netgear
    Product
    Ex7700 Firmware
    Vendor
    Netgear
    Product
    Ex8000
    Vendor
    Netgear
    Product
    Ex8000 Firmware
    Vendor
    Netgear
    Product
    Lbr20
    Vendor
    Netgear
    Product
    Lbr20 Firmware
    Vendor
    Netgear
    Product
    R7800
    Vendor
    Netgear
    Product
    R7800 Firmware
    Vendor
    Netgear
    Product
    R8900
    Vendor
    Netgear
    Product
    R8900 Firmware
    Vendor
    Netgear
    Product
    R9000
    Vendor
    Netgear
    Product
    R9000 Firmware
    Vendor
    Netgear
    Product
    Rbk12
    Vendor
    Netgear
    Product
    Rbk12 Firmware
    Vendor
    Netgear
    Product
    Rbk13
    Vendor
    Netgear
    Product
    Rbk13 Firmware
    Vendor
    Netgear
    Product
    Rbk14
    Vendor
    Netgear
    Product
    Rbk14 Firmware
    Vendor
    Netgear
    Product
    Rbk15
    Vendor
    Netgear
    Product
    Rbk15 Firmware
    Vendor
    Netgear
    Product
    Rbk20
    Vendor
    Netgear
    Product
    Rbk20 Firmware
    Vendor
    Netgear
    Product
    Rbk23
    Vendor
    Netgear
    Product
    Rbk23 Firmware
    Vendor
    Netgear
    Product
    Rbk40
    Vendor
    Netgear
    Product
    Rbk40 Firmware
    Vendor
    Netgear
    Product
    Rbk43
    Vendor
    Netgear
    Product
    Rbk43 Firmware
    Vendor
    Netgear
    Product
    Rbk43s
    Vendor
    Netgear
    Product
    Rbk43s Firmware
    Vendor
    Netgear
    Product
    Rbk44
    Vendor
    Netgear
    Product
    Rbk44 Firmware
    Vendor
    Netgear
    Product
    Rbk50
    Vendor
    Netgear
    Product
    Rbk50 Firmware
    Vendor
    Netgear
    Product
    Rbk53
    Vendor
    Netgear
    Product
    Rbk53 Firmware
    Vendor
    Netgear
    Product
    Rbr10
    Vendor
    Netgear
    Product
    Rbr10 Firmware
    Vendor
    Netgear
    Product
    Rbr20
    Vendor
    Netgear
    Product
    Rbr20 Firmware
    Vendor
    Netgear
    Product
    Rbr40
    Vendor
    Netgear
    Product
    Rbr40 Firmware
    Vendor
    Netgear
    Product
    Rbr50
    Vendor
    Netgear
    Product
    Rbr50 Firmware
    Vendor
    Netgear
    Product
    Rbs10
    Vendor
    Netgear
    Product
    Rbs10 Firmware
    Vendor
    Netgear
    Product
    Rbs20
    Vendor
    Netgear
    Product
    Rbs20 Firmware
    Vendor
    Netgear
    Product
    Rbs40
    Vendor
    Netgear
    Product
    Rbs40 Firmware
    Vendor
    Netgear
    Product
    Rbs50
    Vendor
    Netgear
    Product
    Rbs50 Firmware
    Vendor
    Netgear
    Product
    Rbs50y
    Vendor
    Netgear
    Product
    Rbs50y Firmware
    Vendor
    Netgear
    Product
    Xr450
    Vendor
    Netgear
    Product
    Xr450 Firmware
    Vendor
    Netgear
    Product
    Xr500
    Vendor
    Netgear
    Product
    Xr500 Firmware
    Vendor
    Netgear
    Product
    Xr700
    Vendor
    Netgear
    Product
    Xr700 Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2021-27253 (CVSS 8.8) — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NE…
    CVE-2021-27252 (CVSS 8.8) — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NE…
    CVE-2021-27251 (CVSS 8.8) — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NE…
    CVE-2021-27256 (CVSS 8.8) — This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NE…
    CVE-2021-27255 (CVSS 8.8) — This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R780…
    CVE-2021-27254 (CVSS 8.8) — This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NET…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High