CVE-2020-26907

Vulnerability

A command injection flaw exists in the NETGEAR Orbi Wi-Fi system models RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6. An unauthenticated attacker can inject arbitrary operating system commands through a vulnerable endpoint, without needing any prior authentication. The vulnerability is reachable over the local network, making it exploitable pre-authentication [1].

Exploitation

An attacker must be on the same local network (adjacent access) as the affected device. No authentication or user interaction is required. The attacker sends crafted network requests to a vulnerable service, injecting commands that are then executed by the system. The CVSS vector (AV:A/AC:L/PR:N/UI:N) indicates a low attack complexity and no privileges needed [1].

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands with root-level privileges on the device. This can lead to full compromise of confidentiality, integrity, and availability, including data theft, device manipulation, or adding the device to a botnet. The impact is high across all CIA dimensions, with a CVSS score of 9.6 (Critical) [1].

Mitigation

NETGEAR released fixed firmware version 3.2.16.6 for RBK852, RBR850, and RBS850. Users are strongly advised to upgrade to this version or later via the NETGEAR Support downloads page. No workarounds are documented. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of publication [1].