CVE-2021-34870

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SOAP messages. The issue results from a lack of authentication required for a privileged request. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-13325.

• CWE-306

• https://kb.netgear.com/000063967/Security-Advisory-for-a-Security-Misconfiguration-Vulnerability-on-the-XR1000-PSV-2021-0101Patch, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1058/Third Party Advisory, VDB Entry
• https://kb.netgear.com/000063967/Security-Advisory-for-a-Security-Misconfiguration-Vulnerability-on-the-XR1000-PSV-2021-0101Patch, Vendor Advisory
• https://www.zerodayinitiative.com/advisories/ZDI-21-1058/Third Party Advisory, VDB Entry

Published

Jan 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34865This vulnerability allows network-adjacent attackers to bypa…8.8
• CVE-2021-34866This vulnerability allows local attackers to escalate privil…7.8
• CVE-2021-34867This vulnerability allows local attackers to escalate privil…8.2
• CVE-2021-34868This vulnerability allows local attackers to escalate privil…8.8
• CVE-2021-34869This vulnerability allows local attackers to escalate privil…8.8
• CVE-2021-3487Rejected reason: Non Security Issue. See the binutils securi…
• CVE-2021-34871This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2021-34872This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2021-34873This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2021-34874This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2021-34875This vulnerability allows remote attackers to execute arbitr…7.8
• CVE-2021-34876This vulnerability allows remote attackers to execute arbitr…7.8