CVE-2020-14437
Description
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An unauthenticated command injection vulnerability in multiple NETGEAR WiFi systems allows remote attackers to execute arbitrary commands.
Vulnerability
A pre-authentication command injection vulnerability exists in the firmware of several NETGEAR Orbi WiFi system models. The flaw allows an unauthenticated attacker to inject arbitrary operating system commands through a vulnerable endpoint exposed by the device. Affected models include RBK752, RBK753, RBK753S, RBR750, RBS750, RBK842, RBR840, RBS840, RBK852, RBK853, RBR850, and RBS850 running firmware versions prior to 3.2.15.25 [1]. No authentication is required to reach the vulnerable code path.
Exploitation
An attacker with network access to the affected device can exploit this vulnerability by sending a specially crafted request to the vulnerable service. No prior authentication or user interaction is required. The exact attack vector is not publicly detailed, but the advisory confirms that the injection occurs before any authentication check [1].
Impact
Successful exploitation grants the attacker the ability to execute arbitrary commands with root-level privileges on the device. This can lead to full compromise of the WiFi system, including data exfiltration, installation of malware, and potential use as a pivot point for further attacks on the local network.
Mitigation
NETGEAR has released firmware version 3.2.15.25 to address this vulnerability for all affected models [1]. Users are strongly advised to download and install the latest firmware from NETGEAR Support. No workarounds are provided, and the vulnerability remains exploitable if the firmware is not updated. There is no indication that this CVE is listed in the Known Exploited Vulnerabilities (KEV) catalog.
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- NETGEAR/devicesdescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.