Skip to content
Fencer Vulns
high 7.5

CVE-2021-45556 json

Certain NETGEAR devices are affected by command injection by an authenticated user.

published 2021-12-26 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-32322

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects GS108Tv2 before 5.4.2.36, GS110TPP before 7.0.7.2, GS110TPv2 before 5.4.2.36., GS110TPv3 before 7.0.7.2, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.

Patch / fix

  • netgear gs108tv2_firmware 5.4.2.36
  • netgear gs110tpp_firmware 7.0.7.2
  • netgear gs110tpv2_firmware 5.4.2.36
  • netgear gs308t_firmware 1.0.3.2
  • netgear gs110tpv3_firmware 7.0.7.2
  • netgear gs310tp_firmware 1.0.3.2
  • netgear gs724tpp_firmware 2.0.6.3
  • netgear gs724tpv2_firmware 2.0.6.3
  • netgear gs728tppv2_firmware 6.0.8.2
  • netgear gs728tpv2_firmware 6.0.8.2
  • netgear gs752tpp_firmware 6.0.8.2
  • netgear gs752tpv2_firmware 6.0.8.2
  • netgear ms510txm_firmware 1.0.4.2
  • netgear ms510txup_firmware 1.0.4.2

Exploit prediction

1.22% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AC:H/AV:A/A:H/C:L/I:H/PR:H/S:C/UI:N
CNA 3.1 7.5 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.