CVE-2021-45558

Vulnerability

A post-authentication command injection vulnerability exists in the web interface of certain NETGEAR Orbi WiFi system models. Affected devices include RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6 [1]. An authenticated user can inject arbitrary operating system commands through a crafted HTTP request.

Exploitation

An attacker must have valid credentials to the device's administrative web interface. With network access to the device, the attacker sends a specially crafted request to a vulnerable endpoint, injecting commands that are executed by the underlying system [1]. No additional user interaction is required beyond authentication.

Impact

Successful exploitation allows the attacker to execute arbitrary commands with root privileges on the affected device. This can lead to full compromise of the WiFi system, including unauthorized access to network traffic, modification of device settings, and potential lateral movement within the network [1].

Mitigation

NETGEAR has released firmware version 3.2.16.6 to address this vulnerability. Users are strongly advised to update their devices to this version or later as soon as possible [1]. No workarounds are available; updating the firmware is the only recommended mitigation.