CVE-2021-45542

Vulnerability

A post-authentication command injection vulnerability exists in the web interface of several NETGEAR devices. Affected models include RAX200, RAX75, and RAX80 running firmware versions prior to 1.0.4.120, as well as RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.17.12 [1]. The vulnerability can be triggered by an authenticated user sending specially crafted input to the device's management interface.

Exploitation

An attacker must first authenticate to the device's web-based administration interface. Once authenticated, they can exploit the command injection by submitting malicious input that is not properly sanitized, leading to execution of arbitrary operating system commands [1]. No additional user interaction or network position beyond local network access is required.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands with root privileges on the affected device. This can lead to full compromise of the device, including unauthorized access to network traffic, modification of device configuration, and potential lateral movement within the network [1].

Mitigation

NETGEAR has released fixed firmware versions: 1.0.4.120 for RAX200, RAX75, and RAX80; and 3.2.17.12 for RBK852, RBR850, and RBS850 [1]. Users are strongly advised to update to the latest firmware as soon as possible. No workarounds are available; the only mitigation is applying the firmware update.