CVE-2021-45502

Vulnerability

An authentication bypass vulnerability exists in several NETGEAR WiFi system models. Affected devices include CBR750 before firmware 4.6.3.6, and RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 before firmware 3.2.17.12 [1]. The vulnerability allows an attacker to bypass authentication mechanisms, potentially gaining unauthorized access to the device's administrative interface.

Exploitation

An unauthenticated attacker on the local network can exploit this vulnerability by sending specially crafted network requests to the affected device. No user interaction is required. The advisory does not provide specific exploitation steps, but the attack vector is likely remote (LAN) and does not require authentication [1].

Impact

Successful exploitation allows an attacker to bypass authentication and gain full administrative control over the device. This could lead to information disclosure, modification of device settings, or denial of service [1].

Mitigation

NETGEAR has released firmware updates to address this vulnerability: CBR750 should be updated to version 4.6.3.6, and all other affected models (RBK752, RBR750, RBS750, RBK852, RBR850, RBS850) should be updated to version 3.2.17.12 [1]. Users are strongly advised to download and install the latest firmware from NETGEAR Support. No workarounds have been provided [1].