Not rated
CVE-2021-20170 Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials
Description
Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Netgear RAX43 | 1.0.3.96 | No fix stated |
Other CVEs of Netgear RAX43
The 6 CVEs of Netgear RAX43 →
CVE-2021-20169
Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface
Not rated
CVE-2021-20167
Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability
Not rated
CVE-2021-20168
Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface
Not rated
CVE-2021-20166
Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability
Not rated