What is CVE-2021-38521?

CVE-2021-38521 is a medium-severity vulnerability in NETGEAR R6400, classified under Command Injection. CVSS score: 6.1/10. Published 2021-08-11.

How severe is CVE-2021-38521?

Medium severity. CVSS v3 base score is 6.1 out of 10.

RCE in NETGEAR R6400

CVE-2021-38521

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.50, R7900P before 1.4.1.50, R8000P before 1.4.1.50, RAX75 before 1.0.1.62, and RAX80 before 1.0.1.62.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.009 (55.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L.

Affected products

Netgear R6400
Netgear R6400_firmware
Netgear R7900p
Netgear R7900p_firmware
Netgear R8000p
Netgear R8000p_firmware
Netgear Rax75
Netgear Rax75_firmware
Netgear Rax80
Netgear Rax80_firmware

Weakness classification (CWE)

CWE-77 — Command Injection

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-38521?: CVE-2021-38521 is a medium-severity vulnerability in NETGEAR R6400, classified under Command Injection. CVSS score: 6.1/10. Published 2021-08-11.
How severe is CVE-2021-38521?: Medium severity. CVSS v3 base score is 6.1 out of 10.