What’s Vulnerable › Vulnerabilities

CVE-2021-45676

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-26 · updated 2026-06-17
• Weakness: CWE-79

Description

Certain NETGEAR devices are affected by stored XSS. This affects RAX200 before 1.0.5.126, RAX20 before 1.0.2.82, RAX80 before 1.0.5.126, RAX15 before 1.0.2.82, and RAX75 before 1.0.5.126.

Affected products

• NETGEAR Rax15 Firmware: before 1.0.2.82 — fixed in 1.0.2.82
• NETGEAR Rax200 Firmware: before 1.0.5.126 — fixed in 1.0.5.126
• NETGEAR Rax20 Firmware: before 1.0.2.82 — fixed in 1.0.2.82
• NETGEAR Rax75 Firmware: before 1.0.5.126 — fixed in 1.0.5.126
• NETGEAR Rax80 Firmware: before 1.0.5.126 — fixed in 1.0.5.126

How to fix

Upgrade to a fixed version: NETGEAR Rax15 Firmware 1.0.2.82; NETGEAR Rax200 Firmware 1.0.5.126; NETGEAR Rax20 Firmware 1.0.2.82; NETGEAR Rax75 Firmware 1.0.5.126; NETGEAR Rax80 Firmware 1.0.5.126. Check the vendor advisory for mitigations.

References

• https://kb.netgear.com/000064462/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2020-0161
• https://kb.netgear.com/000064462/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2020-0161

Get alerted when CVE-2021-45676 or the next vulnerability affects your stack