CVE-2021-27254 - CVE House

Back to Database

Status published Medium CVE-2021-27254

This vulnerability allows network-adjacent attackers to bypass authentication on affected...

6.3 CVSS

Vulnerability Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-27254

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

84c0

References

More from NETGEAR

View All →

NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before...

Improper input validation in NETGEAR Nighthawk routers

Improper input validation in NETGEAR Nighthawk router R7000P

Improper input validation in NETGEAR DGN2200v4

Improper certificate validation in firmware update logic in NETGEAR RAX30 and RAXE300

Affected Vendor

NETGEAR

View all reports →

Affected Software

R7800

Vulnerable Versions:

firmware version 1.0.2.76

Timeline

Official Publish: March 5th, 2021

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1552 Unsecured Credentials

Credential Access

T1005 Data from Local System

T1078 Valid Accounts