| CVE ID | CVE-2021-27255 |
| CVSS SCORE | 6.3, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| AFFECTED VENDORS |
NETGEAR |
| AFFECTED PRODUCTS |
R7800 |
| VULNERABILITY DETAILS |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the refresh_status.aspx endpoint. The issue results from a lack of authentication required to start a service on the server. An attacker can leverage this vulnerability to execute code in the context of root. |
| ADDITIONAL DETAILS |
NETGEAR has issued an update to correct this vulnerability. More details can be found at:
https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders |
| DISCLOSURE TIMELINE |
|
| CREDIT | STARLabs |
