CVE-2021-31802
CVSS V2 High 8.3
CVSS V3 High 8.8
Description
NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length value is trusted during a backup.cgi file upload. The attacker must add a \n before the Content-Length header.
Overview
- CVE ID
- CVE-2021-31802
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2021-04-26T13:15:07
- Last Modified Date
- 2021-05-06T20:38:27
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:o:netgear:r7000_firmware:*:*:*:*:*:*:*:* | 1 | OR | 1.0.11.116 | |
| cpe:2.3:h:netgear:r7000:-:*:*:*:*:*:*:* | 0 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:A/AC:L/Au:N/C:C/I:C/A:C
- Access Vector
- ADJACENT_NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- COMPLETE
- Integrity Impact
- COMPLETE
- Availability Impact
- COMPLETE
- Base Score
- 8.3
- Severity
- HIGH
- Exploitability Score
- 6.5
- Impact Score
- 10
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector
- ADJACENT_NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 8.8
- Base Severity
- HIGH
- Exploitability Score
- 2.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/ | Exploit Third Party Advisory |
| https://www.netgear.com/about/security/ | Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-31802 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31802 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 16:16:49 | Added to TrackCVE | |||
| 2022-12-06 02:48:10 | 2021-04-26T13:15Z | 2021-04-26T13:15:07 | CVE Published Date | updated |
| 2022-12-06 02:48:10 | 2021-05-06T20:38:27 | CVE Modified Date | updated | |
| 2022-12-06 02:48:10 | Analyzed | Vulnerability Status | updated |