CVE-2021-29080

Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR854 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 before 2.5.0.10, R7000 before 1.0.11.116, R6900P before 1.3.2.126, R7900 before 1.0.4.38, R7960P before 1.4.1.66, R8000 before 1.0.4.66, R7900P before 1.4.1.66, R8000P before 1.4.1.66, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, and R7000P before 1.3.2.126.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
mitreCNA
8.1 HIGH
ADJACENT_NETWORK
LOW
NONE
CVSS:3.1/AC:L/AV:A/A:N/C:H/I:H/PR:N/S:U/UI:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
VendorProductVersion
netgearrbk852_firmware
𝑥
< 3.2.10.11
netgearrbk853_firmware
𝑥
< 3.2.10.11
netgearrbr854_firmware
𝑥
< 3.2.10.11
netgearrbr850_firmware
𝑥
< 3.2.10.11
netgearrbs850_firmware
𝑥
< 3.2.10.11
netgearcbr40_firmware
𝑥
< 2.5.0.10
netgearr7000_firmware
𝑥
< 1.0.11.116
netgearr6900p_firmware
𝑥
< 1.3.2.126
netgearr7900_firmware
𝑥
< 1.0.4.38
netgearr7960p_firmware
𝑥
< 1.4.1.66
netgearr8000_firmware
𝑥
< 1.0.4.66
netgearr7900p_firmware
𝑥
< 1.4.1.66
netgearr8000p_firmware
𝑥
< 1.4.1.66
netgearrax75_firmware
𝑥
< 1.0.3.102
netgearrax80_firmware
𝑥
< 1.0.3.102
netgearr7000p_firmware
𝑥
< 1.3.2.126
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://kb.netgear.com/000063007/Security-Advisory-for-Pre-authentication-Password-Reset-on-Some-Routers-and-WiFi-Systems-PSV-2019-0150
https://kb.netgear.com/000063007/Security-Advisory-for-Pre-authentication-Password-Reset-on-Some-Routers-and-WiFi-Systems-PSV-2019-0150