CVE-2021-31802
CVE-2021-31802
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 14.2%KEV nãoPoC —Nuclei —Metasploit simPatch —
Lifecycle
21 Apr 2021Metasploit module available
26 Apr 2021Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
NETGEAR R7000 1.0.11.116 devices have a heap-based Buffer Overflow that is exploitable from the local network without authentication. The vulnerability exists within the handling of an HTTP request. An attacker can leverage this to execute code as root. The problem is that a user-provided length value is trusted during a backup.cgi file upload. The attacker must add a \n before the Content-Length header.
Affected products
n/a · n/a