CVE-2021-20170

CVSS v3 8.8 HIGH
CVSS v2.0 6.5 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

N

etgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.

References

Link	Resource
https://www.tenable.com/security/research/tra-2021-55	Third Party Advisory
https://www.tenable.com/security/research/tra-2021-55	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netgear:rax43_firmware:1.0.3.96:*:*:*:*:*:*:*

cpe:2.3:h:netgear:rax43:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:46

Type	Values Removed	Values Added
References	~~() https://www.tenable.com/security/research/tra-2021-55 - Third Party Advisory~~	() https://www.tenable.com/security/research/tra-2021-55 - Third Party Advisory

Information

Published : 2021-12-30 22:15

Updated : 2024-11-21 05:46

NVD link : CVE-2021-20170

Mitre link : CVE-2021-20170

CVE.ORG link : CVE-2021-20170

JSON object : View

Products Affected

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2021-20170", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-12-30T22:15:09.607", "references": [{"url": "https://www.tenable.com/security/research/tra-2021-55", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.tenable.com/security/research/tra-2021-55", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed."}, {"lang": "es", "value": "Netgear RAX43 versi\u00f3n 1.0.3.96, usa credenciales embebidas. No parece que usuarios normales puedan manipular las copias de seguridad de la configuraci\u00f3n debido a que est\u00e1n cifradas. Este cifrado se realiza por medio de un archivo zip protegido por contrase\u00f1a (RAX50w! a4udk). Al descomprimir la configuraci\u00f3n usando esta contrase\u00f1a, un usuario puede reconfigurar los ajustes que no estaban destinados a ser manipulados, volver a comprimir la configuraci\u00f3n y restaurar una copia de seguridad causando que estos ajustes sean cambiados.\n"}], "lastModified": "2024-11-21T05:46:03.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netgear:rax43_firmware:1.0.3.96:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "411B548E-2E7F-4791-A75C-694AD7614E39"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netgear:rax43:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "178BB386-F66C-4CE8-9283-37D22B304691"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}