Skip to content
Fencer Intel
critical 9.6

CVE-2021-45613 json

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.

published 4y ago modified 4mo ago also EUVD-2021-32379

cvss
9.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, D7000v2 before 1.0.0.74, LAX20 before 1.1.6.28, MK62 before 1.0.6.116, MR60 before 1.0.6.116, MS60 before 1.0.6.116, MR80 before 1.1.2.20, MS80 before 1.1.2.20, RAX15 before 1.0.3.96, RAX20 before 1.0.3.96, RAX200 before 1.0.4.120, RAX45 before 1.0.3.96, RAX50 before 1.0.3.96, RAX43 before 1.0.3.96, RAX40v2 before 1.0.3.96, RAX35v2 before 1.0.3.96, RAX75 before 1.0.4.120, RAX80 before 1.0.4.120, RBK752 before 3.2.17.12, RBR750 before 3.2.17.12, RBS750 before 3.2.17.12, RBK852 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, and XR1000 before 1.0.0.58.

Patch / fix

  • netgear cbr40_firmware 2.5.0.24
  • netgear cbr750_firmware 4.6.3.6
  • netgear d7000v2_firmware 1.0.0.74
  • netgear lax20_firmware 1.1.6.28
  • netgear mk62_firmware 1.0.6.116
  • netgear mr60_firmware 1.0.6.116
  • netgear ms60_firmware 1.0.6.116
  • netgear rax15_firmware 1.0.3.96
  • netgear rax20_firmware 1.0.3.96
  • netgear rax200_firmware 1.0.4.120
  • netgear rax35v2_firmware 1.0.3.96
  • netgear rax40v2_firmware 1.0.3.96
  • netgear rax43_firmware 1.0.3.96
  • netgear rax45_firmware 1.0.3.96
  • netgear rax50_firmware 1.0.3.96
  • netgear rax75_firmware 1.0.4.120
  • netgear rax80_firmware 1.0.4.120
  • netgear rbk752_firmware 3.2.17.12
  • netgear rbk852_firmware 3.2.17.12
  • netgear rbr750_firmware 3.2.17.12

Is CVE-2021-45613 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

2.02% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 9.6 CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N
CNA 3.1 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.