CVE-2021-45578

Vulnerability

A post-authentication command injection vulnerability exists in several NETGEAR Orbi WiFi system models, including RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850, running firmware versions prior to 3.2.16.6 [1]. The flaw can be triggered by an authenticated user and does not require additional privileges beyond normal web interface access.

Exploitation

An attacker must first obtain valid authentication credentials for the affected device's web interface. With these credentials, the attacker can inject arbitrary operating system commands through a vulnerable input parameter, bypassing input sanitization [1]. The attack vector is adjacent network (AV:A) and no user interaction is required beyond authentication.

Impact

Successful exploitation leads to arbitrary command execution on the underlying operating system. The attacker gains the ability to execute commands with the privileges of the web server process, which can lead to full compromise of the device, including unauthorized access, data exfiltration, and further network attacks [1].

Mitigation

NETGEAR released fixed firmware version 3.2.16.6 for all affected models. Users should download and install the latest firmware from NETGEAR Support immediately [1]. There is no known workaround for the vulnerability; upgrading firmware is the only mitigation.