CVE-2021-38518

Vulnerability

A command injection vulnerability exists in certain NETGEAR devices, including RAX200, RAX75, RAX80, RBK852, RBR850, and RBS850, running firmware versions prior to 1.0.4.120 (for RAX models) or prior to 3.2.17.12 (for Orbi models). An authenticated user can inject arbitrary commands through a crafted request [1].

Exploitation

An attacker with valid administrative credentials to the affected device can exploit this vulnerability by sending a specially crafted HTTP request to a vulnerable endpoint. No user interaction is required, and the attack can be launched from the adjacent network (LAN) [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges. This leads to full compromise of confidentiality, integrity, and availability, and can affect other components on the network (scope change) [1].

Mitigation

NETGEAR has released fixed firmware versions: 1.0.4.120 for RAX200, RAX75, and RAX80; and 3.2.17.12 for RBK852, RBR850, and RBS850. Users should download and install the latest firmware from NETGEAR Support as soon as possible. No workarounds are available [1].