CVE-2021-27274

CRITICAL 9.8CVE-2021-27274 · Published 29/03/2021 · updated 17/06/2026

In short

CVE-2021-27274 is a CRITICAL (CVSS 9.8) vulnerability affecting prosafe network management system (netgear).
Chance of exploitation in the next 30 days (EPSS): 8.5%, higher than 95.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
prosafe network management system netgear	`= 1.6.0.26`	No fix yet

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MFileUploadController class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-12124.

References

kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560 · Vendor Advisory
zerodayinitiative.com/advisories/ZDI-21-357 · Third Party Advisory

More vulnerabilities in prosafe network management system

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

prosafe network management system

netgear

= 1.6.0.26

No fix yet

Description

More vulnerabilities in prosafe network management system

See all →