CVE-2021-38528
Critical
Published: 11 August 2021
Published
11 August 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1
9.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
0.0369
88.2th percentile
Risk Priority
21
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2021-38528 is a critical-severity Command Injection (CWE-77) vulnerability in Netgear D8500 Firmware. Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-24978
Vulnerability details
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6900P before 1.3.2.132, R7000P before 1.3.2.132, R7100LG before 1.0.0.64, WNDR3400v3 before 1.0.1.38, and XR300 before 1.0.3.56.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
netgear
d8500 firmware
≤ 1.0.3.58
netgear
r6900p firmware
≤ 1.3.2.132
netgear
r7000p firmware
≤ 1.3.2.132
netgear
r7100lg firmware
≤ 1.0.0.64
netgear
wndr3400 firmware
≤ 1.0.1.38
netgear
xr300 firmware
≤ 1.0.3.56
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.