FTP File Download Flaw in NETGEAR R7800 Firmware
CVE-2021-27257

6.5MEDIUM

Key Information:

Vendor

Netgear
Status
R7800
Vendor
CVE Published:
5 March 2021

What is CVE-2021-27257?

The vulnerability allows network-adjacent attackers to compromise the integrity of files downloaded via FTP on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Due to inadequate validation of the certificate presented by the FTP server, an attacker can exploit this weakness without requiring authentication. This flaw can be leveraged alongside other vulnerabilities to execute arbitrary code at the root level, thereby posing significant security risks to the device and its network.

Affected Version(s)

R7800 firmware version 1.0.2.76

References

https://kb.netgear.com/000062883/Security-Advisory-for-Mu...
x_refsource_MISC
https://www.zerodayinitiative.com/advisories/ZDI-21-264/
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

botto
.