NETGEAR GS308T Firmware vulnerabilities

5 CVEs affecting NETGEAR GS308T Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-45557, published 2021-12-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-41314, published 2021-09-16. High severity, CVSS 8.8. EPSS: 13.6% chance of exploitation in the next 30 days. Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or…
CVE-2021-40866, published 2021-09-13. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default) /sqfs/bin/sccd daemon, which fails to check authentication…
CVE-2021-40867, published 2021-09-13. High severity, CVSS 7.1. EPSS: 1.4% chance of exploitation in the next 30 days. Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an admin in the process…
CVE-2021-45557, published 2021-12-26. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an authenticated user. This affects GC108P before 1.0.8.2, GC108PP before 1.0.8.2, GS108Tv3 before 7.0.7.2, GS110TPv3 before 7.0.7.2,…
CVE-2021-45556, published 2021-12-26. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an authenticated user. This affects GS108Tv2 before 5.4.2.36, GS110TPP before 7.0.7.2, GS110TPv2 before 5.4.2.36., GS110TPv3 before…