CVE-2021-45535

Vulnerability

A post-authentication command injection vulnerability exists in the web-based management interface of multiple NETGEAR devices. Affected models include RAX200, RAX80, and RAX75 running firmware versions prior to 1.0.3.106; RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6 [1]. The vulnerability allows an authenticated user to inject arbitrary commands through a crafted request [1].

Exploitation

An attacker must first possess valid administrative credentials for the target device. With authenticated access to the web interface, the attacker can send a specially crafted HTTP request that injects operating system commands into an unsuspecting parameter. The exact injection vector is not publicly detailed in the advisory beyond being a "post-authentication command injection" [1].

Impact

Successful exploitation can allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. This can lead to full compromise of the device, including unauthorized access to network traffic, modification of device configuration, and potential lateral movement within the network [1].

Mitigation

NETGEAR has released fixed firmware versions: 1.0.3.106 for RAX200, RAX80, and RAX75; and 3.2.16.6 for the RBK752/RBR750/RBS750 and RBK852/RBR850/RBS850 series. Users should update to the latest firmware immediately via the NETGEAR Support downloads page. No workarounds are provided, and NETGEAR recommends updating as soon as possible [1].