CVE-2021-45565

Vulnerability

A post-authentication command injection vulnerability exists in certain NETGEAR Orbi WiFi system models, including RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6. An authenticated user with administrative privileges can exploit this flaw to inject arbitrary commands through the web interface [1].

Exploitation

An attacker must have network access to the device and valid administrative credentials. By sending specially crafted HTTP requests to the management interface, the attacker can inject operating system commands that are executed with root privileges. No user interaction is required beyond the initial authentication [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the device as root. This leads to full compromise of the WiFi system, including data exfiltration, installation of malware, or use of the device as a pivot point for further attacks [1].

Mitigation

NETGEAR released firmware version 3.2.16.6 to fix this vulnerability. Users should update their devices immediately by downloading the latest firmware from the NETGEAR support page. No workarounds are available; the only mitigation is applying the firmware update [1].