What is the CVSS score of CVE-2021-45556?

CVE-2021-45556 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Is there a patch available for CVE-2021-45556?

Yes, a patch is available for CVE-2021-45556. Update the affected software to the latest version immediately.

Gs108Tv2 Firmware CVE-2021-45556

HIGH

Command Injection (CWE-77)

2021-12-26 cve@mitre.org

Netgear Command Injection Gs108Tv2 Firmware Gs110Tpp Firmware Gs110Tpv2 Firmware Gs308T Firmware Gs110Tpv3 Firmware Gs310Tp Firmware Gs724Tpp Firmware Gs724Tpv2 Firmware Gs728Tppv2 Firmware Gs728Tpv2 Firmware Gs752Tpp Firmware Gs752Tpv2 Firmware Ms510Txm Firmware Ms510Txup Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Dec 26, 2021 - 01:15 nvd

HIGH 8.8

DescriptionNVD

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects GS108Tv2 before 5.4.2.36, GS110TPP before 7.0.7.2, GS110TPv2 before 5.4.2.36., GS110TPv3 before 7.0.7.2, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.

AnalysisAI

Certain NETGEAR devices are affected by command injection by an authenticated user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. Certain NETGEAR devices are affected by command injection by an authenticated user. This affects GS108Tv2 before 5.4.2.36, GS110TPP before 7.0.7.2, GS110TPv2 before 5.4.2.36., GS110TPv3 before 7.0.7.2, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2. Affected products include: Netgear Gs108Tv2 Firmware, Netgear Gs110Tpp Firmware, Netgear Gs110Tpv2 Firmware, Netgear Gs308T Firmware, Netgear Gs110Tpv3 Firmware. Version information: before 5.4.2.36.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.