← Vulnerability feed

Vulnerability record · CVE-2021-29077 · published 23 March 2021

CVE-2021-29077: Netgear rbw30 firmware command injection vulnerability

Netgear · Rbw30 Firmware

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.

9.6 CVSS 3.1 Critical EPSS 0.81% · top 44.7% CWE-77 · Command injection
9.6CVSS 3.1 base score, v2 5.8
0.81%EPSS exploitation probability, 30 days
NoNot in CISA KEV
13Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBW30 before 2.6.2.2, RBS40V before 2.6.2.4, RBK852 before 3.2.17.12, RBK853 before 3.2.17.12, RBK854 before 3.2.17.12, RBR850 before 3.2.17.12, RBS850 before 3.2.17.12, RBK752 before 3.2.17.12, RBK753 before 3.2.17.12, RBK753S before 3.2.17.12, RBK754 before 3.2.17.12, RBR750 before 3.2.17.12, and RBS750 before 3.2.17.12.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

13 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.netgear.com/000063016/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-202 Vendor Advisory
https://kb.netgear.com/000063016/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-202 Vendor Advisory

Track CVE-2021-29077 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-45630Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 1.7%9.8CVE-2021-45627Netgear cbr750 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6, RBK852 before 3.2.17.12…EPSS 1.7%9.8CVE-2021-45612Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.5%9.8CVE-2021-45617Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, EAX20 before 1.0.0.48, …EPSS 2.1%9.8CVE-2021-45622Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.4%9.8CVE-2021-45613Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.0%9.8CVE-2021-45620Netgear cbr40 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR40 before 2.5.0.24, CBR750 before 4.6.3.6, …EPSS 2.0%9.8CVE-2021-45616Netgear cbr750 firmware command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 3.2.18.2, LAX20 before 1.1.6.28,…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2021-29077), CISA KEV, FIRST EPSS (scores of 2026-10-04). This page is refreshed as NVD updates the record.