CVE-2021-27255

high-risk

Published 2021-03-05

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the refresh_status.aspx endpoint. The issue results from a lack of authentication required to start a service on the server. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12360.

Do I need to act?

1.7% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

ADJACENT_NETWORK / LOW complexity

Affected Products (20)

Br200 Firmware

Br500 Firmware

D7800 Firmware

Ex6100V2 Firmware

Ex6150V2 Firmware

Ex6250 Firmware

Ex6400 Firmware

Ex6400V2 Firmware

Ex6410 Firmware

Ex6420 Firmware

Ex7300 Firmware

Ex7300V2 Firmware

Ex7320 Firmware

Ex7700 Firmware

Ex8000 Firmware

Lbr20 Firmware

R7800 Firmware

R8900 Firmware

R9000 Firmware

Rbk12 Firmware

Affected Vendors

Netgear

References (4)

Patch https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-...

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-21-263/

Patch https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-...

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-21-263/

/ 100

high-risk

Severity 27/34 · High

Exploitability 4/34 · Minimal

Exposure 25/34 · High