CVE-2021-20169

Vulnerability

Netgear RAX43 firmware version 1.0.3.96 does not enforce HTTPS for its web management interface [1]. By default, all communication between the device and the browser is sent over unencrypted HTTP, meaning that any data transmitted—including login credentials, configuration details, and other sensitive information—is sent in cleartext. This affects the default configuration and does not require any special conditions to be reachable.

Exploitation

An attacker with network access (e.g., on the same LAN or able to intercept traffic between the user and the router) can passively capture HTTP traffic. No authentication or user interaction is required beyond the victim accessing the web interface. The attacker can use packet sniffing tools to read the plaintext HTTP requests and responses, extracting usernames, passwords, and other sensitive data.

Impact

Successful exploitation leads to disclosure of sensitive information, including administrator credentials and device configuration. This can allow the attacker to gain unauthorized access to the router's web interface, potentially leading to full compromise of the device and the network it manages.

Mitigation

As of the publication date (2021-12-30), no firmware update has been released to address this issue [1]. Users are advised to avoid accessing the web interface over untrusted networks and to consider using VPN or other encrypted tunnels when managing the device. If remote management is enabled, it should be disabled unless absolutely necessary. The vendor has not yet provided a fix; users should monitor Netgear's support page for future firmware updates.