CVE-2021-20172

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. The installer of the macOS version of Netgear Genie handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which the software is going to be installed may overwrite certain files to obtain privilege escalation to root.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
n/aNetgear Genie Installer for macOSAll known versions

References

Timeline

Published
Dec 30, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-201738.8Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a CVE-2021-201747.5Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication CVE-2021-201757.5Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communicationCVE-2021-201765.5A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file thaCVE-2021-201774.4A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) wheCVE-2021-201785.5A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature wCVE-2021-201798.1A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate CVE-2021-20188.3Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 18c and 19c. DCVE-2021-201805.5A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature wCVE-2021-201817.5A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client CVE-2021-201828.8A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted envirCVE-2021-201835.4It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search