CVE-2020-14440
Description
Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBK753 before 3.2.15.25, RBK753S before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK842 before 3.2.15.25, RBR840 before 3.2.15.25, RBS840 before 3.2.15.25, RBK852 before 3.2.15.25, RBK853 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An unauthenticated attacker can inject arbitrary commands on multiple NETGEAR WiFi system models before firmware 3.2.15.25.
Vulnerability
A pre-authentication command injection vulnerability exists in the web server of multiple NETGEAR Orbi WiFi system models. Affected devices include RBK752, RBK753, RBK753S, RBR750, RBS750, RBK842, RBR840, RBS840, RBK852, RBK853, RBR850, and RBS850 running firmware versions prior to 3.2.15.25 [1]. The vulnerability is triggered without requiring any prior authentication, making the attack surface broad for exposed management interfaces.
Exploitation
An unauthenticated attacker with network access to the affected device's management interface can send specially crafted HTTP requests to inject arbitrary operating system commands. No authentication or user interaction is needed [1]. The exact input vector is not disclosed in the advisory, but the vulnerability is classified as pre-authentication command injection.
Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the underlying operating system with root privileges. This can lead to full device compromise, including data exfiltration, installation of malware, and further lateral movement within the network [1].
Mitigation
NETGEAR has released firmware version 3.2.15.25 that fixes the vulnerability for all affected models. Users are strongly advised to download and install the latest firmware from NETGEAR Support [1]. No workaround is available; the only remediation is applying the firmware update.
AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- NETGEAR/devicesdescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.