Medium severity · published Dec 30, 2021
CVE-2021-20171
Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rax43 Firmware · Netgear
1.0.3.96 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20171
Third Party Advisory
https://www.tenable.com/security/research/tra-2021-55
More from Rax43 Firmware
9.8
CVE-2021-45622
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
9.8
CVE-2021-45621
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
9.8
CVE-2021-45620
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
9.8
CVE-2021-45616
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
9.8
CVE-2021-45614
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker