Medium severity · published Dec 26, 2021
CVE-2021-45494
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files
4.5
CVSS
0.4%
EPSS
No
On KEV
Description
Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects RBK352 before 4.4.0.10, RBR350 before 4.4.0.10, and RBS350 before 4.4.0.10.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rbk352 Firmware · Netgear
before 4.4.0.10 · source: NVD
RF
Rbr350 Firmware · Netgear
before 4.4.0.10 · source: NVD
RF
Rbs350 Firmware · Netgear
before 4.4.0.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45494
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45494
Patch
https://kb.netgear.com/000064160/Security-Advisory-for-Arbitrary-File-Read-on-Some-WiFi-Systems-PSV-2021-0044
More from Rbk352 Firmware
9.8
CVE-2021-45619
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
8.8
CVE-2021-45520
Certain NETGEAR devices are affected by a hardcoded password
7.5
CVE-2021-45653
Certain NETGEAR devices are affected by disclosure of sensitive information
7.5
CVE-2021-45652
Certain NETGEAR devices are affected by disclosure of sensitive information
7.5
CVE-2021-45648
Certain NETGEAR devices are affected by disclosure of sensitive information