Certain NETGEAR devices are affected by disclosure of sensitive information.

published 2021-12-26 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-32414

cvss: 3.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits: 0; none known

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects EX6100v2 before 1.0.1.106, EX6150v2 before 1.0.1.106, EX6250 before 1.0.0.146, EX6400 before 1.0.2.164, EX6400v2 before 1.0.0.146, EX6410 before 1.0.0.146, EX6420 before 1.0.0.146, EX7300 before 1.0.2.164, EX7300v2 before 1.0.0.146, EX7320 before 1.0.0.146, EX7700 before 1.0.0.222, LBR1020 before 2.6.5.16, LBR20 before 2.6.5.2, RBK352 before 4.3.4.7, RBK50 before 2.7.3.22, RBR350 before 4.3.4.7, RBR50 before 2.7.3.22, and RBS350 before 4.3.4.7.

Patch / fix

fixed in 18 links 1

netgear ex6100v2_firmware 1.0.1.106
netgear ex6150v2_firmware 1.0.1.106
netgear ex6250_firmware 1.0.0.146
netgear ex6400_firmware 1.0.2.164
netgear ex6400v2_firmware 1.0.0.146
netgear ex6410_firmware 1.0.0.146
netgear ex6420_firmware 1.0.0.146
netgear ex7300_firmware 1.0.2.164
netgear ex7300v2_firmware 1.0.0.146
netgear ex7320_firmware 1.0.0.146
netgear ex7700_firmware 1.0.0.222
netgear lbr1020_firmware 2.6.5.16
netgear lbr20_firmware 2.6.5.2
netgear rbk352_firmware 4.3.4.7
netgear rbk50_firmware 2.7.3.22
netgear rbr350_firmware 4.3.4.7
netgear rbr50_firmware 2.7.3.22
netgear rbs350_firmware 4.3.4.7

kb.netgear.com/000064494/Security-Advisory-for-Sensitive-Information-Disc… advisory

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	3.1	CVSS:3.1/AC:H/AV:A/A:N/C:L/I:N/PR:N/S:U/UI:N
CNA	3.1	3.1	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

kb.netgear.com /000064494/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-Extenders-and-WiFi-Systems-P
patch, vendor-advisory

Sources

CVE List CVE-2021-45648
NVD CVE-2021-45648

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary