NETGEAR XR450 Firmware vulnerabilities

23 CVEs affecting NETGEAR XR450 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9212, published 2026-06-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-45618, published 2021-12-26. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.64, EX6200v2 before 1.0.1.86, EX6250 before 1.0.0.134, EX7700 before…
CVE-2020-35800, published 2020-12-30. Critical severity, CVSS 9.4. EPSS: 1.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600 before 1.2.0.72, CBK40 before 2.5.0.10, CBR40…
CVE-2021-27255, published 2021-03-05. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this…
CVE-2021-38516, published 2021-08-11. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before 1.0.0.52, D7800 before 1.0.1.44, D8500…
CVE-2020-35799, published 2020-12-30. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.78, D6200 before 1.1.00.32, D7000 before…
CVE-2020-35795, published 2020-12-30. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600 before 1.2.0.72, CBK40 before 2.5.0.10,…
CVE-2021-27253, published 2021-04-14. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability,…
CVE-2021-27252, published 2021-04-14. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this…
CVE-2021-29068, published 2021-03-23. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R6700v3 before 1.0.4.98, R6400v2 before 1.0.4.98, R7000 before 1.0.11.106, R6900P before 1.3.2.124,…
CVE-2021-27256, published 2021-03-05. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Although authentication is required to exploit…

Latest

CVE-2026-9212, published 2026-06-09. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain…
CVE-2021-34947, published 2024-05-07. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. NETGEAR R7800 net-cgi Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR…
CVE-2021-45642, published 2021-12-26. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.64, EX6250 before 1.0.0.134, EX7700 before 1.0.0.222, LBR20 before 2.6.3.50,…
CVE-2021-45640, published 2021-12-26. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6200 before 1.1.00.34, D6220 before 1.0.0.52, D6400…
CVE-2021-45603, published 2021-12-26. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by disclosure of sensitive information. A UPnP request reveals a device's serial number, which can be used for a password reset. This affects D7800 before…
CVE-2021-45602, published 2021-12-26. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.66, EX2700 before 1.0.1.68, WN3000RPv2 before 1.0.0.90, WN3000RPv3 before…
CVE-2021-38534, published 2021-08-11. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. Certain NETGEAR devices are affected by stored XSS. This affects D3600 before 1.0.0.76, D6000 before 1.0.0.76, D6100 before 1.0.0.60, D6200 before 1.1.00.36, D6220 before 1.0.0.52, D6400 before…