CVE-2021-45579

Vulnerability

A post-authentication command injection vulnerability exists in certain NETGEAR WiFi system models. Affected products include RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6 [1]. An authenticated user can inject arbitrary commands into the system through a vulnerable input parameter.

Exploitation

An attacker must first authenticate to the device's administrative interface. Once authenticated, the attacker can send a crafted request containing injected commands to a vulnerable endpoint. No additional privileges or network position beyond LAN access to the management interface is required [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the affected device with root privileges. This can lead to full compromise of the device, including unauthorized access, modification of settings, and potential use as a pivot point within the network [1].

Mitigation

NETGEAR has released firmware version 3.2.16.6 for all affected models to fix this vulnerability. Users should update their devices to this version or later immediately via the NETGEAR Support page. No workarounds are documented; updating is the only mitigation [1].