Threat Investigation
Request a demo

CVE-2021-45628

Critical

Description

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBS40V before 2.6.2.4, and RBW30 before 2.6.2.2.

SeverityCritical
CVSS9.6
Exploit probability—
ProductNetgear Cbr40 Firmware
PublishedDec 26, 2021
First seenDec 26, 2021

How to fix

Update
  • netgear cbr40_firmware2.5.0.24 or later
  • netgear cbr750_firmware3.2.18.2 or later
  • netgear rbk752_firmware3.2.17.12 or later
  • netgear rbr750_firmware3.2.17.12 or later
  • netgear rbs750_firmware3.2.17.12 or later
  • netgear rbk852_firmware3.2.17.12 or later
  • netgear rbr850_firmware3.2.17.12 or later
  • netgear rbs850_firmware3.2.17.12 or later
  • netgear rbs40v_firmware2.6.2.4 or later
  • netgear rbw30_firmware2.6.2.2 or later

Affected products

ProductAffected versionsFixed in
netgear cbr40_firmwarev < 2.5.0.242.5.0.24
netgear cbr750_firmwarev < 3.2.18.23.2.18.2
netgear rbk752_firmwarev < 3.2.17.123.2.17.12
netgear rbr750_firmwarev < 3.2.17.123.2.17.12
netgear rbs750_firmwarev < 3.2.17.123.2.17.12
netgear rbk852_firmwarev < 3.2.17.123.2.17.12
netgear rbr850_firmwarev < 3.2.17.123.2.17.12
netgear rbs850_firmwarev < 3.2.17.123.2.17.12
netgear rbs40v_firmwarev < 2.6.2.4, 2.6.2.42.6.2.4
netgear rbw30_firmwarev < 2.6.2.22.6.2.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.