CVE-2021-20170 describes a hardcoded credentials vulnerability in Netgear RAX43 firmware version 1.0.3.96. An authenticated attacker can exploit a hardcoded password (RAX50w!a4udk) used to encrypt configuration backups, allowing them to decrypt, modify, and re-encrypt the configuration. This high-severity vulnerability (CVSS 8.8) has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.0.3.96CPE matchmatch criteria | cpe:2.3:o:netgear:rax43_firmware:1.0.3.96:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Netgear Nighthawk RAX43 Multiple Vulnerabilities
Dec 30, 2021Netgear Nighthawk RAX43 Multiple Vulnerabilities
Dec 30, 2021Netgear Nighthawk RAX43 Multiple Vulnerabilities
Dec 30, 2021