Certain NETGEAR devices are affected by password recovery and file access.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear d8500 firmwareup to 1.0.3.27 inclusive
• netgear dgn2200 firmwareup to 1.0.0.82 inclusive
• netgear r6300 firmwareup to 1.0.4.06 inclusive
• netgear r6400 firmwareup to 1.0.1.20 inclusive
• netgear r6400 firmwareup to 1.0.2.18 inclusive
• netgear r6700 firmwareup to 1.0.1.22 inclusive
• netgear r6900 firmwareup to 1.0.1.20 inclusive
• netgear r7000 firmwareup to 1.0.7.10 inclusive
• netgear r7000p firmwareup to 1.0.0.58 inclusive
• netgear r7100lg firmwareup to 1.0.0.28 inclusive
• netgear r7300dst firmwareup to 1.0.0.52 inclusive
• netgear r7900 firmwareup to 1.0.1.12 inclusive
• netgear r8000 firmwareup to 1.0.3.46 inclusive
• netgear r8300 firmwareup to 1.0.2.86 inclusive
• netgear r8500 firmwareup to 1.0.2.86 inclusive
• netgear wndr3400 firmwareup to 1.0.1.8 inclusive
• netgear wndr4500 firmwareup to 1.0.0.62 inclusive

Other highest-scoring records for the same primary product.

• CVE-2021-38528Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
  40Plan
• CVE-2021-45609Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
  39Monitor
• CVE-2021-38539Certain NETGEAR devices are affected by privilege escalation.
  35Monitor
• CVE-2018-21093Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
  35Monitor
• CVE-2019-20762Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
  27Monitor
• CVE-2019-20713Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user.
  27Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.