Cyber Resilience

CVE-2021-29080

High

Published: 23 March 2021

Published
23 March 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0009 25.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-29080 is a high-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Netgear Rbk852 Firmware. Its CVSS base score is 8.1 (High).

Operationally, ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Certain NETGEAR devices are affected by password reset by an unauthenticated attacker. This affects RBK852 before 3.2.10.11, RBK853 before 3.2.10.11, RBR854 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 before 2.5.0.10, R7000 before 1.0.11.116, R6900P before 1.3.2.126, R7900 before…

more

1.0.4.38, R7960P before 1.4.1.66, R8000 before 1.0.4.66, R7900P before 1.4.1.66, R8000P before 1.4.1.66, RAX75 before 1.0.3.102, RAX80 before 1.0.3.102, and R7000P before 1.3.2.126.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

netgear
rbk852 firmware
≤ 3.2.10.11
netgear
rbk853 firmware
≤ 3.2.10.11
netgear
rbr854 firmware
≤ 3.2.10.11
netgear
rbr850 firmware
≤ 3.2.10.11
netgear
rbs850 firmware
≤ 3.2.10.11
netgear
cbr40 firmware
≤ 2.5.0.10
netgear
r7000 firmware
≤ 1.0.11.116
netgear
r6900p firmware
≤ 1.3.2.126
netgear
r7900 firmware
≤ 1.0.4.38
netgear
r7960p firmware
≤ 1.4.1.66
+6 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-640

Establishing procedures for lost or compromised authenticators addresses weak password recovery mechanisms.

References