Vulnerability record · CVE-2021-27272 · published 29 March 2021
CVE-2021-27272: NETGEAR ProSAFE NMS path traversal allows arbitrary file deletion
Netgear · Prosafe Network Management System
CVE-2021-27272 is a path traversal (CWE-22) in the ReportTemplateController class of NETGEAR ProSAFE Network Management System 1.6.0.26. The path parameter is not validated before being used in file operations, letting an attacker delete arbitrary files. The result is a denial-of-service condition on the management system.
Description
This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ReportTemplateController class. When parsing the path parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-12123.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Automated analysis
high priorityNetwork-reachable path traversal with authentication bypass leading to arbitrary file deletion and high availability impact, with very high EPSS despite no KEV listing.
What it is
CVE-2021-27272 is a path traversal (CWE-22) in the ReportTemplateController class of NETGEAR ProSAFE Network Management System 1.6.0.26. The path parameter is not validated before being used in file operations, letting an attacker delete arbitrary files. The result is a denial-of-service condition on the management system.
Impact
An attacker can delete arbitrary files on the affected installation, degrading or disabling the NMS and producing a denial-of-service condition. The CVSS vector shows no confidentiality impact and low integrity impact, with availability rated high.
Attack surface
The flaw is network-reachable (AV:N) with no user interaction (UI:N). Authentication is nominally required (PR:L), but the description states the existing authentication mechanism can be bypassed, so the practical barrier is lower than the vector implies.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.73766, 99.45th percentile), indicating elevated predicted exploitation activity, but the references are only vendor and third-party advisories with no public exploit tag.
What to do
- Apply the NETGEAR security advisory fix for NMS300 (PSV-2020-0537) and upgrade from 1.6.0.26 to the patched release.
- Restrict network access to the ProSAFE NMS management interface to trusted administrative networks only.
- Do not expose the NMS web interface to the internet; place it behind a firewall or VPN.
- Audit and harden the authentication mechanism, since the advisory states it can be bypassed.
- Maintain offline backups of NMS configuration and report templates to speed recovery from file deletion.
Detection
- Monitor NMS logs for requests to ReportTemplateController endpoints containing traversal sequences such as ../ or encoded variants.
- Alert on unexpected deletion or disappearance of files in NMS installation and report template directories.
- Watch for authentication bypass attempts or anomalous sessions preceding file-operation requests on the NMS host.
- Baseline and monitor NMS service availability for abrupt outages consistent with file deletion.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://kb.netgear.com/000062723/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0537 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-355/ | Third Party AdvisoryVDB Entry |
| https://kb.netgear.com/000062723/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0537 | Vendor Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-21-355/ | Third Party AdvisoryVDB Entry |
Track CVE-2021-27272 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-27272), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
