CVE-2021-45564

Vulnerability

A post-authentication command injection vulnerability exists in several NETGEAR Orbi WiFi system models. Affected devices include RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6. The vulnerability can be triggered by an authenticated user, allowing injection of arbitrary commands through a management interface [1].

Exploitation

An attacker must first obtain valid authentication credentials for the device's web interface or other management services. With authenticated access, the attacker can craft a malicious request that injects operating system commands into a vulnerable parameter. The injected commands are executed on the device with elevated privileges [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the affected device with root privileges. This can lead to full compromise of the device, including unauthorized access to network traffic, modification of device configuration, and potential pivot to other devices on the network [1].

Mitigation

NETGEAR has released firmware version 3.2.16.6 to address this vulnerability. Users are strongly advised to download and install the latest firmware for their affected models from the NETGEAR Support website. No workarounds have been provided; updating to the fixed firmware is the only mitigation [1].