Certain NETGEAR devices are affected by disclosure of sensitive information.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• netgear d7000 firmwarebefore 1.0.1.52
• netgear d7800 firmwarebefore 1.0.1.31
• netgear d8500 firmwarebefore 1.0.3.36
• netgear jnr1010 firmwarebefore 1.1.0.46
• netgear jr6150 firmwarebefore 1.0.1.14
• netgear jwnr2010 firmwarebefore 1.1.0.46
• netgear pr2000 firmwarebefore 1.0.0.20
• netgear r6050 firmwarebefore 1.0.1.14
• netgear r6220 firmwarebefore 1.1.0.60
• netgear r6400 firmwarebefore 1.1.0.26
• netgear r6400 firmwarebefore 1.0.2.46
• netgear r6700 firmwarebefore 1.2.0.2
• netgear r6800 firmwarebefore 1.2.0.2
• netgear r6900 firmwarebefore 1.2.0.2
• netgear r7300dst firmwarebefore 1.0.0.56
• netgear r7500 firmwarebefore 1.0.0.112
• netgear r7500 firmwarebefore 1.0.3.24
• netgear r7800 firmwarebefore 1.0.2.36
• netgear r7900p firmwarebefore 1.1.4.6
• netgear r8000p firmwarebefore 1.1.4.6

Other highest-scoring records for the same primary product.

• CVE-2021-45497NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
  40Plan
• CVE-2021-45496NETGEAR D7000 devices before 1.0.1.82 are affected by authentication bypass.
  40Plan
• CVE-2021-45512Certain NETGEAR devices are affected by weak cryptography.
  39Monitor
• CVE-2021-45495NETGEAR D7000 devices before 1.0.1.68 are affected by authentication bypass.
  39Monitor
• CVE-2021-45636NETGEAR D7000 devices before 1.0.1.82 are affected by a stack-based buffer overflow by an unauthenticated attacker.
  35Monitor
• CVE-2018-21169Certain NETGEAR devices are affected by incorrect configuration of security settings.
  35Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.