CVE-2021-45608

Katalog CVE

CVSS 9.8 · Critical EPSS 2,5%

Kerentanan Integer Overflow or Wraparound pada netgear d7800 firmware, netgear r6400v2 firmware +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Certain D-Link, Edimax, NETGEAR, TP-Link, Tenda, and Western Digital devices are affected by an integer overflow by an unauthenticated attacker. Remote code execution from the WAN interface (TCP port 20005) cannot be ruled out; however, exploitability was judged to be of "rather significant complexity" but not "impossible." The overflow is in SoftwareBus_dispatchNormalEPMsgOut in the KCodes NetUSB kernel module. Affected NETGEAR devices are D7800 before 1.0.1.68, R6400v2 before 1.0.4.122, and R6700v3 before 1.0.4.122.

Rincian

Terbit di NVD

26 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kb.netgear.com/000064437/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Multiple-Products... patch · advisory vendor
• https://www.sentinelone.com/labs/cve-2021-45608-netusb-rce-flaw-in-millions-of-end-user-routers/ exploit · patch · advisory pihak ketiga