CVE-2021-45570

Vulnerability

A post-authentication command injection vulnerability exists in certain NETGEAR Orbi WiFi 6 system models. The flaw resides in the web management interface and allows an authenticated user to inject arbitrary operating system commands. Affected models are RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6 [1].

Exploitation

An attacker must first obtain valid administrative credentials for the affected device. With authenticated access to the web interface, the attacker can send specially crafted input that is not properly sanitized, leading to command injection [1]. No user interaction beyond authentication is required.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web server process. This can lead to full compromise of the device, including the ability to modify configuration, exfiltrate data, or disrupt network services [1].

Mitigation

NETGEAR released firmware version 3.2.16.6 to address this vulnerability on all listed models. Users should download and install the latest firmware from NETGEAR Support as soon as possible [1]. No workaround is available; users must update to the fixed version.