CVE-2021-45536

Vulnerability

A post-authentication command injection vulnerability exists in several NETGEAR routers and WiFi systems. The affected models are RAX75, RAX80, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, running firmware versions prior to 1.0.3.106 (for RAX75/RAX80) or prior to 3.2.16.6 (for the WiFi systems) [1]. An authenticated user can inject commands via a vulnerable input field.

Exploitation

An attacker must have valid credentials to log into the device's web interface. After authentication, the attacker can send specially crafted HTTP requests containing operating system commands. The advisory does not disclose the exact vulnerable parameter, but typical exploitation involves injecting command separators into fields that are insufficiently sanitized [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the device with elevated privileges. This can lead to full compromise of the affected device, including unauthorized access to network traffic, modification of settings, and potential lateral movement within the network [1].

Mitigation

NETGEAR has released firmware fixes for all affected models. Users should update RAX75 and RAX80 to version 1.0.3.106 or later, and the WiFi system models (RBK752, RBR750, RBS750, RBK852, RBR850, RBS850) to version 3.2.16.6 or later [1]. No workarounds are provided; updating to the latest firmware is the only recommended mitigation.