CVE-2021-27254: NETGEAR BR200 Firmware

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.

Affected products

NETGEAR BR200 Firmware: before 5.10.0.5 (fixed in 5.10.0.5)
NETGEAR BR500 Firmware: before 5.10.0.5 (fixed in 5.10.0.5)
NETGEAR d7800 Firmware: before 1.0.1.60 (fixed in 1.0.1.60)
NETGEAR EX6100V2 Firmware: before 1.0.1.98 (fixed in 1.0.1.98)
NETGEAR EX6150V2 Firmware: before 1.0.1.98 (fixed in 1.0.1.98)
NETGEAR EX6250 Firmware: before 1.0.0.134 (fixed in 1.0.0.134)
NETGEAR EX6400 Firmware: before 1.0.2.158 (fixed in 1.0.2.158)
NETGEAR EX6400V2 Firmware: before 1.0.0.134 (fixed in 1.0.0.134)
NETGEAR EX6410 Firmware: before 1.0.0.134 (fixed in 1.0.0.134)
NETGEAR EX6420 Firmware: before 1.0.0.134 (fixed in 1.0.0.134)
NETGEAR EX7300 Firmware: before 1.0.2.158 (fixed in 1.0.2.158)
NETGEAR EX7300V2 Firmware: before 1.0.0.134 (fixed in 1.0.0.134)
NETGEAR EX7320 Firmware: before 1.0.0.134 (fixed in 1.0.0.134)
NETGEAR EX7700 Firmware: before 1.0.0.216 (fixed in 1.0.0.216)
NETGEAR EX8000 Firmware: before 1.0.1.232 (fixed in 1.0.1.232)
NETGEAR LBR20 Firmware: before 2.6.3.50 (fixed in 2.6.3.50)
NETGEAR r7800 Firmware: before 1.0.2.80 (fixed in 1.0.2.80)
NETGEAR r8900 Firmware: before 1.0.5.28 (fixed in 1.0.5.28)
NETGEAR r9000 Firmware: before 1.0.5.28 (fixed in 1.0.5.28)
NETGEAR RBK12 Firmware: before 2.7.2.104 (fixed in 2.7.2.104)
NETGEAR RBK13 Firmware: before 2.7.2.104 (fixed in 2.7.2.104)
NETGEAR RBK14 Firmware: before 2.7.2.104 (fixed in 2.7.2.104)
NETGEAR RBK15 Firmware: before 2.7.2.104 (fixed in 2.7.2.104)
NETGEAR RBK20 Firmware: before 2.6.2.104 (fixed in 2.6.2.104)
NETGEAR RBK23 Firmware: before 2.7.2.104 (fixed in 2.7.2.104)
and 18 more

Published 2021-03-05. Last modified 2026-06-17.