Read the docs
TI-2021-20735 Aliases CVE-2021-45648GHSA-hhm5-85r6-q9w9

Certain NETGEAR devices are affected by disclosure of sensitive information.

Priority LOW 34CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects EX6100v2 before 1.0.1.106, EX6150v2 before 1.0.1.106, EX6250 before 1.0.0.146, EX6400 before 1.0.2.164, EX6400v2 before 1.0.0.146, EX6410 before 1.0.0.146, EX6420 before 1.0.0.146, EX7300 before 1.0.2.164, EX7300v2 before 1.0.0.146, EX7320 before 1.0.0.146, EX7700 before 1.0.0.222, LBR1020 before 2.6.5.16, LBR20 before 2.6.5.2, RBK352 before 4.3.4.7, RBK50 before 2.7.3.22, RBR350 before 4.3.4.7, RBR50 before 2.7.3.22, and RBS350 before 4.3.4.7.

Why it matters now

EPSS 0.00809 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:o:netgear:ex6100v2_firmware:*:*:*:*:*:*:*:*before 1.0.1.106VulnerableNETGEAR
cpe:2.3:h:netgear:ex6100v2:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex6150v2_firmware:*:*:*:*:*:*:*:*before 1.0.1.106VulnerableNETGEAR
cpe:2.3:h:netgear:ex6150v2:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex6250_firmware:*:*:*:*:*:*:*:*before 1.0.0.146VulnerableNETGEAR
cpe:2.3:h:netgear:ex6250:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex6400_firmware:*:*:*:*:*:*:*:*before 1.0.2.164VulnerableNETGEAR
cpe:2.3:h:netgear:ex6400:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex6400v2_firmware:*:*:*:*:*:*:*:*before 1.0.0.146VulnerableNETGEAR
cpe:2.3:h:netgear:ex6400v2:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:ex6100v2_firmware:*:*:*:*:*:*:*:* Versions before 1.0.1.106 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex6100v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex6150v2_firmware:*:*:*:*:*:*:*:* Versions before 1.0.1.106 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex6150v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex6250_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.146 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex6250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex6400_firmware:*:*:*:*:*:*:*:* Versions before 1.0.2.164 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex6400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex6400v2_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.146 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex6400v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:netgear:ex6410_firmware:*:*:*:*:*:*:*:*before 1.0.0.146VulnerableNETGEAR
cpe:2.3:h:netgear:ex6410:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex6420_firmware:*:*:*:*:*:*:*:*before 1.0.0.146VulnerableNETGEAR
cpe:2.3:h:netgear:ex6420:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex7300_firmware:*:*:*:*:*:*:*:*before 1.0.2.164VulnerableNETGEAR
cpe:2.3:h:netgear:ex7300:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex7300v2_firmware:*:*:*:*:*:*:*:*before 1.0.0.146VulnerableNETGEAR
cpe:2.3:h:netgear:ex7300v2:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex7320_firmware:*:*:*:*:*:*:*:*before 1.0.0.146VulnerableNETGEAR
cpe:2.3:h:netgear:ex7320:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:ex7700_firmware:*:*:*:*:*:*:*:*before 1.0.0.222VulnerableNETGEAR
cpe:2.3:h:netgear:ex7700:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:*before 2.6.5.16VulnerableNETGEAR
cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:*before 2.6.5.2VulnerableNETGEAR
cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbk352_firmware:*:*:*:*:*:*:*:*before 4.3.4.7VulnerableNETGEAR
cpe:2.3:h:netgear:rbk352:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbk50_firmware:*:*:*:*:*:*:*:*before 2.7.3.22VulnerableNETGEAR
cpe:2.3:h:netgear:rbk50:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr350_firmware:*:*:*:*:*:*:*:*before 4.3.4.7VulnerableNETGEAR
cpe:2.3:h:netgear:rbr350:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbr50_firmware:*:*:*:*:*:*:*:*before 2.7.3.22VulnerableNETGEAR
cpe:2.3:h:netgear:rbr50:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
cpe:2.3:o:netgear:rbs350_firmware:*:*:*:*:*:*:*:*before 4.3.4.7VulnerableNETGEAR
cpe:2.3:h:netgear:rbs350:-:*:*:*:*:*:*:*not specified by NVDRunning onNETGEAR
  • cpe:2.3:o:netgear:ex6410_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.146 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex6410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex6420_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.146 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex6420:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex7300_firmware:*:*:*:*:*:*:*:* Versions before 1.0.2.164 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex7300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex7300v2_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.146 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex7300v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex7320_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.146 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex7320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:ex7700_firmware:*:*:*:*:*:*:*:* Versions before 1.0.0.222 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:ex7700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:lbr1020_firmware:*:*:*:*:*:*:*:* Versions before 2.6.5.16 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:lbr1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:lbr20_firmware:*:*:*:*:*:*:*:* Versions before 2.6.5.2 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:lbr20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbk352_firmware:*:*:*:*:*:*:*:* Versions before 4.3.4.7 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbk352:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbk50_firmware:*:*:*:*:*:*:*:* Versions before 2.7.3.22 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbk50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr350_firmware:*:*:*:*:*:*:*:* Versions before 4.3.4.7 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbr50_firmware:*:*:*:*:*:*:*:* Versions before 2.7.3.22 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbr50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR
  • cpe:2.3:o:netgear:rbs350_firmware:*:*:*:*:*:*:*:* Versions before 4.3.4.7 Vulnerable ·NETGEAR
  • cpe:2.3:h:netgear:rbs350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NETGEAR

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-45648
  2. 2026-10-03 Alias added: GHSA-hhm5-85r6-q9w9

References

Patch 1

  • TI-2021-20706 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
  • TI-2021-20705 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. CVSS 3.1CRITICAL 9.8
  • TI-2021-20745 Certain NETGEAR devices are affected by server-side injection. CVSS 3.1CRITICAL 9.8
  • TI-2020-18244 Certain NETGEAR devices are affected by incorrect configuration of security settings. CVSS 3.1CRITICAL 9.4
  • TI-2020-18243 Certain NETGEAR devices are affected by a stack-based buffer overflow by an… CVSS 3.1CRITICAL 9.8
  • TI-2021-08795 Missing authentication in NETGEAR R7800 CVSS 3.1HIGH 8.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences