NETGEAR GS724TP Firmware vulnerabilities

5 CVEs affecting NETGEAR GS724TP Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-41314, published 2021-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-41314, published 2021-09-16. High severity, CVSS 8.8. EPSS: 13.6% chance of exploitation in the next 30 days. Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or…
CVE-2021-33514, published 2021-05-21. Critical severity, CVSS 9.8. EPSS: 7.9% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a CGI application, as demonstrated by…
CVE-2021-40866, published 2021-09-13. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default) /sqfs/bin/sccd daemon, which fails to check authentication…
CVE-2021-40867, published 2021-09-13. High severity, CVSS 7.1. EPSS: 1.4% chance of exploitation in the next 30 days. Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the same source IP address as an admin in the process…
CVE-2019-20676, published 2020-04-15. Medium severity, CVSS 6.0. EPSS: 0.3% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects FS728TLP before 1.0.1.26, GS105Ev2 before 1.6.0.4, GS105PE before 1.6.0.4, GS108Ev3 before 2.06.08,…