CVE-2021-45562

Vulnerability

A post-authentication command injection vulnerability exists in certain NETGEAR WiFi system models, including RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6 [1]. The vulnerability allows an authenticated attacker to inject arbitrary operating system commands through a vulnerable input parameter [1].

Exploitation

To exploit this vulnerability, an attacker must first authenticate to the affected device [1]. No further privileges beyond standard user access are required. After authentication, the attacker can craft a specially designed request containing malicious command injection payloads to the vulnerable component [1]. No user interaction beyond the initial authentication is needed [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the underlying operating system [1]. This can lead to full compromise of the device, including unauthorized access to sensitive data, modification of system configurations, and potential use of the device as a pivot point for further network attacks [1]. The CVSS v3.1 score for this vulnerability is 8.4 (Medium severity), with the vector indicating a low attack complexity and the need for adjacent network access [1].

Mitigation

NETGEAR has released firmware version 3.2.16.6 that fixes this vulnerability for all affected models: RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 [1]. Users should download and install the latest firmware from NETGEAR Support as soon as possible [1]. No workarounds or mitigations other than updating the firmware have been provided [1].