Details of VAR-202109-1948

ID

VAR-202109-1948

CVE

CVE-2021-34947

TITLE

Out-of-bounds write vulnerability in multiple Netgear products

Trust: 0.8

sources: JVNDB: JVNDB-2021-021936

DESCRIPTION

NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the soap_block_table file. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13055. D7800 firmware, EX2700 firmware, EX6100 Multiple Netgear products, including firmware, contain an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The NETGEAR R7800 is an AC2600 dual-band router released by NETGEAR. It supports simultaneous data transmission between multiple devices and achieves a maximum wireless transmission rate of 2.53 Gbps

Trust: 2.88

sources: NVD: CVE-2021-34947 // JVNDB: JVNDB-2021-021936 // ZDI: ZDI-21-1116 // CNVD: CNVD-2025-18550 // VULMON: CVE-2021-34947

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-18550

AFFECTED PRODUCTS

vendor:	netgear	model:	r7800	scope:	-	version:	-	Trust: 1.3
vendor:	netgear	model:	rbs50	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	r7800	scope:	lt	version:	1.0.2.84	Trust: 1.0
vendor:	netgear	model:	lbr20	scope:	lt	version:	2.6.5.32	Trust: 1.0
vendor:	netgear	model:	rbr40	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	ex6200	scope:	lt	version:	1.0.1.86	Trust: 1.0
vendor:	netgear	model:	wnr2000v5	scope:	lt	version:	1.0.0.78	Trust: 1.0
vendor:	netgear	model:	ex6150	scope:	lt	version:	1.0.1.106	Trust: 1.0
vendor:	netgear	model:	ex6400	scope:	lt	version:	1.0.2.164	Trust: 1.0
vendor:	netgear	model:	rbs10	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	rbs40	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	ex6420	scope:	lt	version:	1.0.0.146	Trust: 1.0
vendor:	netgear	model:	d7800	scope:	lt	version:	1.0.1.64	Trust: 1.0
vendor:	netgear	model:	rax78	scope:	lt	version:	1.0.5.108	Trust: 1.0
vendor:	netgear	model:	xr700	scope:	lt	version:	1.0.1.44	Trust: 1.0
vendor:	netgear	model:	ex7300	scope:	lt	version:	1.0.2.164	Trust: 1.0
vendor:	netgear	model:	rax70	scope:	lt	version:	1.0.5.108	Trust: 1.0
vendor:	netgear	model:	ex7700	scope:	lt	version:	1.0.0.222	Trust: 1.0
vendor:	netgear	model:	ex7320	scope:	lt	version:	1.0.0.146	Trust: 1.0
vendor:	netgear	model:	ex6400v2	scope:	lt	version:	1.0.0.146	Trust: 1.0
vendor:	netgear	model:	ex6410	scope:	lt	version:	1.0.0.146	Trust: 1.0
vendor:	netgear	model:	rbr10	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	rax120	scope:	lt	version:	1.2.2.24	Trust: 1.0
vendor:	netgear	model:	r6700ax	scope:	lt	version:	1.0.5.108	Trust: 1.0
vendor:	netgear	model:	rax10	scope:	lt	version:	1.0.5.108	Trust: 1.0
vendor:	netgear	model:	rbs20	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	ex2700	scope:	lt	version:	1.0.1.66	Trust: 1.0
vendor:	netgear	model:	rax120v2	scope:	lt	version:	1.2.2.24	Trust: 1.0
vendor:	netgear	model:	r9000	scope:	lt	version:	1.0.5.36	Trust: 1.0
vendor:	netgear	model:	rbs50y	scope:	lt	version:	2.7.4.12	Trust: 1.0
vendor:	netgear	model:	ex6100	scope:	lt	version:	1.0.1.106	Trust: 1.0
vendor:	netgear	model:	rbr20	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	ex7300v2	scope:	lt	version:	1.0.0.146	Trust: 1.0
vendor:	netgear	model:	ex8000	scope:	lt	version:	1.0.1.238	Trust: 1.0
vendor:	netgear	model:	xr450	scope:	lt	version:	2.3.2.130	Trust: 1.0
vendor:	netgear	model:	ex6250	scope:	lt	version:	1.0.0.146	Trust: 1.0
vendor:	netgear	model:	lbr1020	scope:	lt	version:	2.6.5.32	Trust: 1.0
vendor:	netgear	model:	rbr50	scope:	lt	version:	2.7.4.24	Trust: 1.0
vendor:	netgear	model:	xr500	scope:	lt	version:	2.3.2.130	Trust: 1.0
vendor:	netgear	model:	r8900	scope:	lt	version:	1.0.5.36	Trust: 1.0
vendor:	netgear	model:	ex6500v1	scope:	lt	version:	1.0.0.146	Trust: 1.0
vendor:	netgear	model:	wn3000rpv2	scope:	lt	version:	1.0.0.88	Trust: 1.0
vendor:	ネットギア	model:	ex6200	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6100	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6400	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	lbr20	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex7300	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r7800	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6410	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex7320	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex8000	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6150	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex2700	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex7700	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	r6700ax	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6400v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	lbr1020	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex7300v2	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6420	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6250	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	d7800	scope:	-	version:	-	Trust: 0.8
vendor:	ネットギア	model:	ex6500v1	scope:	-	version:	-	Trust: 0.8

sources: ZDI: ZDI-21-1116 // CNVD: CNVD-2025-18550 // JVNDB: JVNDB-2021-021936 // NVD: CVE-2021-34947

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com:	CVE-2021-34947
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2021-021936
value:	HIGH
Trust: 0.8
ZDI:	CVE-2021-34947
value:	HIGH
Trust: 0.7
CNVD:	CNVD-2025-18550
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202109-1872
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2025-18550
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2021-34947
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.0
OTHER:	JVNDB-2021-021936
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2021-34947
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-21-1116 // CNVD: CNVD-2025-18550 // JVNDB: JVNDB-2021-021936 // CNNVD: CNNVD-202109-1872 // NVD: CVE-2021-34947

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	Out-of-bounds writing (CWE-787) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-021936 // NVD: CVE-2021-34947

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202109-1872

PATCH

title:	NETGEAR has issued an update to correct this vulnerability.	url:	https://kb.netgear.com/000064044/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2021-0129	Trust: 0.7
title:	Patch for NETGEAR R7800 Buffer Overflow Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/713061	Trust: 0.6
title:	Netgear NETGEAR R7800 Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=164868	Trust: 0.6

sources: ZDI: ZDI-21-1116 // CNVD: CNVD-2025-18550 // CNNVD: CNNVD-202109-1872

EXTERNAL IDS

db:	NVD	id:	CVE-2021-34947	Trust: 4.6
db:	ZDI	id:	ZDI-21-1116	Trust: 3.8
db:	JVNDB	id:	JVNDB-2021-021936	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-13055	Trust: 0.7
db:	CNVD	id:	CNVD-2025-18550	Trust: 0.6
db:	CS-HELP	id:	SB2021100101	Trust: 0.6
db:	CNNVD	id:	CNNVD-202109-1872	Trust: 0.6
db:	VULMON	id:	CVE-2021-34947	Trust: 0.1

sources: ZDI: ZDI-21-1116 // CNVD: CNVD-2025-18550 // VULMON: CVE-2021-34947 // JVNDB: JVNDB-2021-021936 // CNNVD: CNNVD-202109-1872 // NVD: CVE-2021-34947

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-21-1116/	Trust: 3.1
url:	https://kb.netgear.com/000064044/security-advisory-for-pre-authentication-buffer-overflow-on-some-routers-psv-2021-0129	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2021-34947	Trust: 0.8
url:	https://www.cybersecurity-help.cz/vdb/sb2021100101	Trust: 0.6

sources: ZDI: ZDI-21-1116 // CNVD: CNVD-2025-18550 // VULMON: CVE-2021-34947 // JVNDB: JVNDB-2021-021936 // CNNVD: CNNVD-202109-1872 // NVD: CVE-2021-34947

CREDITS

Hoang Thach Nguyen of STAR Labs

Trust: 1.3

sources: ZDI: ZDI-21-1116 // CNNVD: CNNVD-202109-1872

SOURCES

db:	ZDI	id:	ZDI-21-1116
db:	CNVD	id:	CNVD-2025-18550
db:	VULMON	id:	CVE-2021-34947
db:	JVNDB	id:	JVNDB-2021-021936
db:	CNNVD	id:	CNNVD-202109-1872
db:	NVD	id:	CVE-2021-34947

LAST UPDATE DATE

2025-08-26T23:37:01.238000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-21-1116	date:	2021-09-28T00:00:00
db:	CNVD	id:	CNVD-2025-18550	date:	2025-08-15T00:00:00
db:	JVNDB	id:	JVNDB-2021-021936	date:	2025-08-25T07:11:00
db:	CNNVD	id:	CNNVD-202109-1872	date:	2021-10-08T00:00:00
db:	NVD	id:	CVE-2021-34947	date:	2025-08-14T01:42:44.800

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-21-1116	date:	2021-09-28T00:00:00
db:	CNVD	id:	CNVD-2025-18550	date:	2025-07-29T00:00:00
db:	JVNDB	id:	JVNDB-2021-021936	date:	2025-08-25T00:00:00
db:	CNNVD	id:	CNNVD-202109-1872	date:	2021-09-28T00:00:00
db:	NVD	id:	CVE-2021-34947	date:	2024-05-07T23:15:07.653