What’s Vulnerable › Vulnerabilities

CVE-2021-27254

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-05 · updated 2026-06-17
• Weakness: CWE-259

Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.

Affected products

• NETGEAR Br200 Firmware: before 5.10.0.5 — fixed in 5.10.0.5
• NETGEAR Br500 Firmware: before 5.10.0.5 — fixed in 5.10.0.5
• NETGEAR D7800 Firmware: before 1.0.1.60 — fixed in 1.0.1.60
• NETGEAR Ex6100V2 Firmware: before 1.0.1.98 — fixed in 1.0.1.98
• NETGEAR Ex6150V2 Firmware: before 1.0.1.98 — fixed in 1.0.1.98
• NETGEAR Ex6250 Firmware: before 1.0.0.134 — fixed in 1.0.0.134
• NETGEAR Ex6400 Firmware: before 1.0.2.158 — fixed in 1.0.2.158
• NETGEAR Ex6400V2 Firmware: before 1.0.0.134 — fixed in 1.0.0.134
• NETGEAR Ex6410 Firmware: before 1.0.0.134 — fixed in 1.0.0.134
• NETGEAR Ex6420 Firmware: before 1.0.0.134 — fixed in 1.0.0.134
• NETGEAR Ex7300 Firmware: before 1.0.2.158 — fixed in 1.0.2.158
• NETGEAR Ex7300V2 Firmware: before 1.0.0.134 — fixed in 1.0.0.134
• NETGEAR Ex7320 Firmware: before 1.0.0.134 — fixed in 1.0.0.134
• NETGEAR Ex7700 Firmware: before 1.0.0.216 — fixed in 1.0.0.216
• NETGEAR Ex8000 Firmware: before 1.0.1.232 — fixed in 1.0.1.232
• NETGEAR Lbr20 Firmware: before 2.6.3.50 — fixed in 2.6.3.50
• NETGEAR R7800 Firmware: before 1.0.2.80 — fixed in 1.0.2.80
• NETGEAR R8900 Firmware: before 1.0.5.28 — fixed in 1.0.5.28
• NETGEAR R9000 Firmware: before 1.0.5.28 — fixed in 1.0.5.28
• NETGEAR Rbk12 Firmware: before 2.7.2.104 — fixed in 2.7.2.104
• NETGEAR Rbk13 Firmware: before 2.7.2.104 — fixed in 2.7.2.104
• NETGEAR Rbk14 Firmware: before 2.7.2.104 — fixed in 2.7.2.104
• NETGEAR Rbk15 Firmware: before 2.7.2.104 — fixed in 2.7.2.104
• NETGEAR Rbk20 Firmware: before 2.6.2.104 — fixed in 2.6.2.104
• NETGEAR Rbk23 Firmware: before 2.7.2.104 — fixed in 2.7.2.104
• NETGEAR Rbk40 Firmware: before 2.6.2.104 — fixed in 2.6.2.104
• NETGEAR Rbk43 Firmware: before 2.6.2.104 — fixed in 2.6.2.104
• NETGEAR Rbk43S Firmware: before 2.6.2.104 — fixed in 2.6.2.104
• NETGEAR Rbk44 Firmware: before 2.6.2.104 — fixed in 2.6.2.104
• NETGEAR Rbk50 Firmware: before 2.7.2.104 — fixed in 2.7.2.104

How to fix

Upgrade to a fixed version: NETGEAR Br200 Firmware 5.10.0.5; NETGEAR Br500 Firmware 5.10.0.5; NETGEAR D7800 Firmware 1.0.1.60; NETGEAR Ex6100V2 Firmware 1.0.1.98; NETGEAR Ex6150V2 Firmware 1.0.1.98; NETGEAR Ex6250 Firmware 1.0.0.134; NETGEAR Ex6400 Firmware 1.0.2.158; NETGEAR Ex6400V2 Firmware 1.0.0.134; NETGEAR Ex6410 Firmware 1.0.0.134; NETGEAR Ex6420 Firmware 1.0.0.134; NETGEAR Ex7300 Firmware 1.0.2.158; NETGEAR Ex7300V2 Firmware 1.0.0.134. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders
• https://www.zerodayinitiative.com/advisories/ZDI-21-252/
• https://kb.netgear.com/000062883/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Routers-Satellites-and-Extenders
• https://www.zerodayinitiative.com/advisories/ZDI-21-252/

Get alerted when CVE-2021-27254 or the next vulnerability affects your stack