CVE Feed

    Dashboard / CVE / CVE-2021-34870

    CVE-2021-34870

    This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13325.

    Published:Jan 25, 2022
    Last Modified:Nov 21, 2024
    EPS:Jan 25, 2022
    EPSS Score:0.00292
    CVSS Score:6.5

    Affected Products

    Vendor
    Netgear
    Product
    Xr1000

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-9215 (CVSS 1.8) — A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leve…
    CVE-2026-11736 (CVSS 1.9) — A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin use…
    CVE-2026-11735 (CVSS 1.9) — A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin …
    CVE-2026-11739 (CVSS 4.9) — A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent att…
    CVE-2026-62657 (CVSS 4.9) — A security flaw in the router's certificate validation process was discovered in the NETGEAR XR1000 Gaming Rou…
    CVE-2026-0418 (CVSS 4.3) — Insufficient configuration management in the listed devices allows authenticated administrators connected to t…
    CVE-2026-0417 (CVSS 4.3) — Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators …
    CVE-2026-9210 (CVSS 4.9) — Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators c…
    CVE-2026-9213 (CVSS 6.9) — A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamp…
    CVE-2026-0410 (CVSS 1.9) — Authenticated administrators connected to the local network can gain elevated access to the router and make u…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High