CVE-2020-35794
Description
Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBS40V before 2.6.1.4, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
NETGEAR Orbi WiFi systems are affected by a post-authentication command injection vulnerability, allowing an authenticated attacker to execute arbitrary commands on affected devices.
Vulnerability
A post-authentication command injection vulnerability exists in certain NETGEAR WiFi system models. Affected devices include the RBS40V before firmware version 2.6.1.4, and the RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 before firmware version 3.2.15.25 [1]. The vulnerability requires an authenticated user to trigger the command injection via the web interface or other management functions [1].
Exploitation
An attacker must first obtain valid authentication credentials for the target device. Once authenticated, the attacker can exploit the injection point to inject arbitrary operating system commands. The advisory does not provide specific details on the attack vector or the input field used for injection [1].
Impact
Successful exploitation allows an authenticated attacker to execute arbitrary commands on the device with elevated privileges, potentially leading to full compromise of the device's functionality and data [1].
Mitigation
NETGEAR released firmware updates to address this vulnerability: version 2.6.1.4 for the RBS40V, and version 3.2.15.25 for the RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850. Users should update to the latest firmware as soon as possible [1].
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
4- NETGEAR/devicesdescription
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.