Web UI Injection Vulnerability in NETGEAR Smart Switches
CVE-2021-41314

8.8HIGH

Key Information:

Vendor
Netgear
Status
Gc108p Firmware
Vendor
CVE Published:
16 September 2021

Summary

Certain NETGEAR smart switches exhibit a vulnerability in their web UI's password field, allowing an attacker to exploit weaknesses in the authentication mechanism. This flaw enables an unauthenticated attacker to craft admin sessions or overwrite files with specific content. Such access can compromise the web UI's integrity and allow full administrative control. Affected models require prompt attention to mitigate potential risks.

References

https://kb.netgear.com/000063978/Security-Advisory-for-Mu...
x_refsource_MISC
https://gynvael.coldwind.pl/?id=742
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.