CVE-2021-359739.8CriticalCWE-697

CVE-2021-35973: Netgear Wac104 Firmware vulnerability

Netgear · Wac104 Firmware

Affected: Netgear Wac104 Firmware · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

3.1%probability of exploitation in the next 30 days

87th percentile

050100

Higher than 87% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by adding the &currentsetting.htm substring to the HTTP query, a related issue to CVE-2020-27866. This directly allows the attacker to change the web UI password, and eventually to enable debug mode (telnetd) and gain a shell on the device as the admin limited-user account (however, escalation to root is simple because of weak permissions on the /etc/ directory).

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Incorrect Comparison · Input Validation and Logic
Vendor: Netgear
Published: June 2021
Band: Possible (1 to 10%), June 2021

CoverageNo articles yet

No CyberSIXT article names CVE-2021-35973 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.