Vulnerability-Lookup

CNVD-2022-02648

Vulnerability from cnvd - Published: 2022-01-12

Title

Netgear RAX43存在未明漏洞（CNVD-2022-02648）

Description

Netgear RAX43是美国网件（Netgear）公司的一款无线路由器。 Netgear RAX43存在安全漏洞，该漏洞源于使用硬编码凭据。由于配置备份是加密的，因此普通用户似乎并不打算能够操作配置备份。这种加密是通过带有硬编码密码 (RAX50w!a4udk) 的受密码保护的 zip 文件完成的。通过使用此密码解压缩配置，用户可以重新配置不打算被操纵的设置，重新压缩配置，并恢复导致这些设置被更改的备份。目前没有详细的漏洞细节提供。

Severity

中

Patch Name

Netgear RAX43存在未明漏洞（CNVD-2022-02648）的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.tenable.com/security/research/tra-2021-55

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-20170

Impacted products

Name
NETGEAR RAX43 1.0.3.96

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-20170"
    }
  },
  "description": "Netgear RAX43\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08Netgear\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002\n\nNetgear RAX43\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4f7f\u7528\u786c\u7f16\u7801\u51ed\u636e\u3002 \u7531\u4e8e\u914d\u7f6e\u5907\u4efd\u662f\u52a0\u5bc6\u7684\uff0c\u56e0\u6b64\u666e\u901a\u7528\u6237\u4f3c\u4e4e\u5e76\u4e0d\u6253\u7b97\u80fd\u591f\u64cd\u4f5c\u914d\u7f6e\u5907\u4efd\u3002 \u8fd9\u79cd\u52a0\u5bc6\u662f\u901a\u8fc7\u5e26\u6709\u786c\u7f16\u7801\u5bc6\u7801 (RAX50w!a4udk) \u7684\u53d7\u5bc6\u7801\u4fdd\u62a4\u7684 zip \u6587\u4ef6\u5b8c\u6210\u7684\u3002 \u901a\u8fc7\u4f7f\u7528\u6b64\u5bc6\u7801\u89e3\u538b\u7f29\u914d\u7f6e\uff0c\u7528\u6237\u53ef\u4ee5\u91cd\u65b0\u914d\u7f6e\u4e0d\u6253\u7b97\u88ab\u64cd\u7eb5\u7684\u8bbe\u7f6e\uff0c\u91cd\u65b0\u538b\u7f29\u914d\u7f6e\uff0c\u5e76\u6062\u590d\u5bfc\u81f4\u8fd9\u4e9b\u8bbe\u7f6e\u88ab\u66f4\u6539\u7684\u5907\u4efd\u3002 \u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.tenable.com/security/research/tra-2021-55",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-02648",
  "openTime": "2022-01-12",
  "patchDescription": "Netgear RAX43\u662f\u7f8e\u56fd\u7f51\u4ef6\uff08Netgear\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u65e0\u7ebf\u8def\u7531\u5668\u3002\r\n\r\nNetgear RAX43\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u4f7f\u7528\u786c\u7f16\u7801\u51ed\u636e\u3002 \u7531\u4e8e\u914d\u7f6e\u5907\u4efd\u662f\u52a0\u5bc6\u7684\uff0c\u56e0\u6b64\u666e\u901a\u7528\u6237\u4f3c\u4e4e\u5e76\u4e0d\u6253\u7b97\u80fd\u591f\u64cd\u4f5c\u914d\u7f6e\u5907\u4efd\u3002 \u8fd9\u79cd\u52a0\u5bc6\u662f\u901a\u8fc7\u5e26\u6709\u786c\u7f16\u7801\u5bc6\u7801 (RAX50w!a4udk) \u7684\u53d7\u5bc6\u7801\u4fdd\u62a4\u7684 zip \u6587\u4ef6\u5b8c\u6210\u7684\u3002 \u901a\u8fc7\u4f7f\u7528\u6b64\u5bc6\u7801\u89e3\u538b\u7f29\u914d\u7f6e\uff0c\u7528\u6237\u53ef\u4ee5\u91cd\u65b0\u914d\u7f6e\u4e0d\u6253\u7b97\u88ab\u64cd\u7eb5\u7684\u8bbe\u7f6e\uff0c\u91cd\u65b0\u538b\u7f29\u914d\u7f6e\uff0c\u5e76\u6062\u590d\u5bfc\u81f4\u8fd9\u4e9b\u8bbe\u7f6e\u88ab\u66f4\u6539\u7684\u5907\u4efd\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Netgear RAX43\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2022-02648\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "NETGEAR RAX43 1.0.3.96"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-20170",
  "serverity": "\u4e2d",
  "submitTime": "2022-01-03",
  "title": "Netgear RAX43\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2022-02648\uff09"
}

CVE-2021-20170 (GCVE-0-2021-20170)

Vulnerability from cvelistv5 – Published: 2021-12-30 21:31 – Updated: 2024-08-03 17:30

Summary

Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.

Severity

No CVSS data available.

CWE

Hardcoded Credential

Assigner

tenable CNA under the mitre root

CNA scorecard C 71/100 over 52 records in the last 180 days details

References

1 reference

URL	Tags
https://www.tenable.com/security/research/tra-2021-55	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	Netgear RAX43	Affected: 1.0.3.96

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:30:07.477Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/research/tra-2021-55"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Netgear RAX43",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.3.96"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Hardcoded Credential",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-12-30T21:31:15.000Z",
        "orgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
        "shortName": "tenable"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.tenable.com/security/research/tra-2021-55"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnreport@tenable.com",
          "ID": "CVE-2021-20170",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Netgear RAX43",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.0.3.96"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Hardcoded Credential"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.tenable.com/security/research/tra-2021-55",
              "refsource": "MISC",
              "url": "https://www.tenable.com/security/research/tra-2021-55"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
    "assignerShortName": "tenable",
    "cveId": "CVE-2021-20170",
    "datePublished": "2021-12-30T21:31:15.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:30:07.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted