High severity · published Dec 30, 2021
CVE-2021-45077
Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NN
Netgear Nighthawk R6700 ·
1.0.4.120 · source: vendor
RF
R6700 Firmware · Netgear
1.0.4.120 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45077
Third Party Advisory
https://www.tenable.com/security/research/tra-2021-57
More from Netgear Nighthawk R6700
8.8
CVE-2021-20173
Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device
8.8
CVE-2021-45732
Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential
7.5
CVE-2021-20174
Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface
7.5
CVE-2021-20175
Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface
6.8
CVE-2021-23147
Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console