CVE-2021-45675 Cross-site scripting in n/a
Stored XSS in NETGEAR routers allows attackers to inject scripts, potentially leading to session hijacking or malicious actions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-45675?
CVE-2021-45675 is a medium-severity cross-site scripting vulnerability in Netgear R6120 Firmware, published on 26 Dec 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Certain NETGEAR devices are affected by stored XSS. This affects R6120 before 1.0.0.76, R6260 before 1.1.0.78, R6850 before 1.1.0.78, R6350 before 1.1.0.78, R6330 before 1.1.0.78, R6800 before 1.2.0.76, R6700v2 before 1.2.0.76, R6900v2 before 1.2.0.76, R7200 before 1.2.0.76, R7350 before 1.2.0.76, R7400 before 1.2.0.76, R7450 before 1.2.0.76, AC2100 before 1.2.0.76, AC2400 before 1.2.0.76, and AC2600 before 1.2.0.76.
Weakness: CWE-79
Which versions are affected by CVE-2021-45675?
It affects 15 products.
Products include Netgear Ac2100 Firmware, Netgear Ac2400 Firmware, Netgear Ac2600 Firmware, Netgear R6120 Firmware, Netgear R6260 Firmware, Netgear R6330 Firmware and 9 more.
How do I fix CVE-2021-45675?
No fix has been published for CVE-2021-45675 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-45675 being exploited?
There is no known exploitation of CVE-2021-45675 in the wild and no public exploit code.
Other vulnerabilities in Netgear R6120 Firmware
Sources
Also known as GHSA-jr8h-85hr-jr68.