TI-2021-19936 Aliases CVE-2021-44262 GHSA-4cwq-w82q-39jg

A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version…

LOW 37CWE-306Published 2022-03-17 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.

Summary

A vulnerability is in the 'MNU_top.htm' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information for the device.

Why it matters now

EPSS 0.0219 82nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:netgear:mbr1517_firmware::::::::	all versions	Vulnerable	NETGEAR
cpe:2.3:h:netgear:mbr1517:v2:::::::*	v2	Running on	NETGEAR
cpe:2.3:o:netgear:wnce3001_firmware::::::::	all versions	Vulnerable	NETGEAR
cpe:2.3:h:netgear:wnce3001:-:::::::*	not specified by NVD	Running on	NETGEAR
cpe:2.3:o:netgear:wac104_firmware::::::::	up to 1.0.4.13	Vulnerable	NETGEAR
cpe:2.3:h:netgear:wac104:-:::::::*	not specified by NVD	Running on	NETGEAR

cpe:2.3:o:netgear:mbr1517_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·NETGEAR
cpe:2.3:h:netgear:mbr1517:v2:*:*:*:*:*:*:* Versions v2 Running on ·NETGEAR
cpe:2.3:o:netgear:wnce3001_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·NETGEAR
cpe:2.3:h:netgear:wnce3001:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
cpe:2.3:o:netgear:wac104_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4.13 Vulnerable ·NETGEAR
cpe:2.3:h:netgear:wac104:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-44262
2026-10-03 Alias added: GHSA-4cwq-w82q-39jg

References

Exploit 1

https://github.com/zer0yu/CVE_Request/blob/master/netgear/Netgear_W104_unauthorized_access_vulnerability_second.md

Advisory 1

https://www.netgear.com/about/security/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences