CVE-2021-38521

Vulnerability

A post-authentication command injection vulnerability exists in multiple NETGEAR router models. The affected devices include R6400 before firmware version 1.0.1.50, R7900P before 1.4.1.50, R8000P before 1.4.1.50, RAX75 before 1.0.1.62, and RAX80 before 1.0.1.62. An authenticated user can inject commands via a crafted HTTP request.

Exploitation

An attacker must have valid credentials for the device's web interface. After logging in, the attacker can send a specially crafted request to exploit the command injection flaw. No additional privileges or user interaction beyond authentication is required.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with root privileges. This can lead to full compromise of the device, including data exfiltration, configuration changes, or denial of service.

Mitigation

NETGEAR has released firmware updates to fix this vulnerability. Users should upgrade to the latest firmware: R6400 to version 1.0.1.50 or later, R7900P to 1.4.1.50 or later, R8000P to 1.4.1.50 or later, RAX75 to 1.0.1.62 or later, and RAX80 to 1.0.1.62 or later. No workarounds are available; updating firmware is the only mitigation [1].