← Vulnerability feed

Vulnerability record · CVE-2021-45677 · published 26 December 2021

CVE-2021-45677: Netgear gs108t firmware cross-site scripting vulnerability

Netgear · Gs108t Firmware

Certain NETGEAR devices are affected by stored XSS. This affects GS108Tv2 before 5.4.2.36 and GS110TPv2 before 5.4.2.36.

6.1 CVSS 3.1 Medium EPSS 0.60% · top 53.6% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score, v2 4.3
0.60%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Certain NETGEAR devices are affected by stored XSS. This affects GS108Tv2 before 5.4.2.36 and GS110TPv2 before 5.4.2.36.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://kb.netgear.com/000064448/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Smart-Managed-Pro-Switches-PS PatchVendor Advisory
https://kb.netgear.com/000064448/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Smart-Managed-Pro-Switches-PS PatchVendor Advisory

Track CVE-2021-45677 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-33514Netgear gc108p firmware os command injection vulnerabilityCertain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library used by a…EPSS 7.9%8.8CVE-2021-41314Netgear gc108p firmware injection vulnerabilityCertain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentica…EPSS 14%8.8CVE-2021-40866Netgear gc108p firmware vulnerabilityCertain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default) /sqfs/bin/…EPSS 1.8%7.7CVE-2017-18860Netgear fs752tp firmware injection vulnerabilityCertain NETGEAR devices are affected by debugging command execution. This affects FS752TP 5.4.2.19 and earlier, GS108Tv2 5.4.2.29 and earlier, GS110T…EPSS 0.55%7.1CVE-2021-40867Netgear gc108p firmware authentication bypass by spoofing vulnerabilityCertain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who uses the s…EPSS 1.4%6.1CVE-2026-42897Microsoft Exchange Server XSS enables spoofingMicrosoft Exchange Server and Exchange Server Subscription Edition fail to neutralize input during web page generation, a cross-site scripting flaw (…KEVEPSS 0.52%analysed6.1CVE-2025-48700Zimbra Classic UI stored XSS via crafted email HTMLZimbra Collaboration Suite Classic UI fails to properly sanitize HTML content in email messages, allowing crafted tag structures and attribute values…KEVEPSS 1.7%analysed6.1CVE-2025-66376Zimbra Collaboration Classic UI stored XSS via CSS @import in emailZimbra Collaboration Suite 10 before 10.0.18 and 10.1 before 10.1.13 allows stored cross-site scripting in the Classic UI through CSS @import directi…KEVEPSS 20%analysed

Source: NIST National Vulnerability Database (record CVE-2021-45677), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.