CVE-2021-38539
6.3 MEDIUMCertain NETGEAR devices are affected by privilege escalation
Published: 2021-08-11 · Last updated: 2026-06-17
Severity and scoring
- CVSS
- 6.3 MEDIUM
- Vector
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected products
| Vendor | Product |
|---|---|
| netgear | d8500_firmware, r6400_firmware, r6700_firmware |
Description
Certain NETGEAR devices are affected by privilege escalation. This affects D8500 before 1.0.3.44, R6400v2 before 1.0.2.66, R6700 before 1.0.2.6, R6700v3 before 1.0.2.66, R6900 before 1.0.2.4, R6900P before 1.3.2.126, R7000 before 1.0.9.42, R7000P before 1.3.2.126, R7100LG before 1.0.0.50, R7300DST before 1.0.0.70, R7900 before 1.0.3.10, R8300 before 1.0.2.130, and R8500 before 1.0.2.130.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-38539
- [Vendor advisory]https://kb.netgear.com/000063760/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-and-Gateways-PSV-2018-0385
- [Vendor advisory]https://kb.netgear.com/000063760/Security-Advisory-for-Vertical-Privilege-Escalation-on-Some-Routers-and-Gateways-PSV-2018-0385
Related CVEs
Same vendor
- CVE-2021-40847 — The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execu... (8.1 HIGH)
- CVE-2021-41383 — setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_serve... (7.2 HIGH)
- CVE-2021-41314 — Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of th... (8.8 HIGH)
- CVE-2021-40867 — Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker wh... (7.8 HIGH)
- CVE-2021-40866 — Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default... (9.8 CRITICAL)