CVE-2021-41314
CVE-2021-41314 is a high-severity vulnerability in Netgear Gc108p Firmware with a CVSS 3.x base score of 8.8. Its EPSS exploit-prediction score of 14% places it in the 96th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-74.
Key facts
- Severity: High (CVSS 3.x base score 8.8)
- CVSS v2: 8.3
- EPSS exploit prediction: 14% (96th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-74
- Affected product: Netgear Gc108p Firmware
- Published:
- Last modified:
Description
Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.
Frequently asked questions
- What is CVE-2021-41314?
- Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2" string). This leads to admin session crafting and therefore gaining full web UI admin privileges by an unauthenticated attacker. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPP before 7.0.7.2, GS110TPv3 before 7.0.7.2, GS110TUP before 1.0.5.3, GS308T before 1.0.3.2, GS310TP before 1.0.3.2, GS710TUP before 1.0.5.3, GS716TP before 1.0.4.2, GS716TPP before 1.0.4.2, GS724TPP before 2.0.6.3, GS724TPv2 before 2.0.6.3, GS728TPPv2 before 6.0.8.2, GS728TPv2 before 6.0.8.2, GS750E before 1.0.1.10, GS752TPP before 6.0.8.2, GS752TPv2 before 6.0.8.2, MS510TXM before 1.0.4.2, and MS510TXUP before 1.0.4.2.
- How severe is CVE-2021-41314?
- CVE-2021-41314 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2021-41314 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 14% (96th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-41314?
- CVE-2021-41314 primarily affects Netgear Gc108p Firmware. In total, 20 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-41314?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-41314 published?
- CVE-2021-41314 was published on 2021-09-16 and last updated on 2026-06-17.
References
- https://gynvael.coldwind.pl/?id=742
- https://kb.netgear.com/000063978/Security-Advisory-for-Multiple-Vulnerabilities-on-Some-Smart-Switches-PSV-2021-0140-PSV-2021-0144-PSV-2021-0145
Affected products (20)
- cpe:2.3:o:netgear:gc108p_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gc108pp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs108t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs110tpp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs110tp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs110tup_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs308t_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs310tp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs710tup_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs716tp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs716tpp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs724tpp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs724tp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs728tpp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs728tp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs750e_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs752tpp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:gs752tp_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:ms510txm_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:netgear:ms510txup_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Netgear Gc108p Firmware
- CVE-2021-40866 — Critical (CVSS 9.8): Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the…
- CVE-2021-33514 — High (CVSS 8.8): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable…
- CVE-2021-40867 — High (CVSS 7.8): Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an…
- CVE-2021-45557 — High (CVSS 7.5): Certain NETGEAR devices are affected by command injection by an authenticated user. This affects GC108P before 1.0.8.2,…
All CVEs affecting Netgear Gc108p Firmware →
Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities
- CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
- CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
- CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
- CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…
Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →