CVE-2021-45583

Vulnerability

A post-authentication command injection vulnerability exists in the web interface of several NETGEAR WiFi system models. The flaw affects firmware versions prior to 3.2.16.6 on the following devices: RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850. An authenticated user can inject arbitrary operating system commands through specially crafted HTTP requests, leading to remote code execution [1].

Exploitation

An attacker must first authenticate to the device's web administration interface. No additional privileges beyond standard user authentication are required. The attacker then sends crafted input to a vulnerable parameter, which is not properly sanitized before being passed to a system shell. The exact attack vector is not publicly detailed, but the advisory confirms that command injection is possible [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the web server process, typically root. This results in full compromise of the affected device, including the ability to modify configuration, access sensitive data, and pivot to other network hosts [1].

Mitigation

NETGEAR has released firmware version 3.2.16.6 to fix this vulnerability. Users should update their devices to this version or later immediately via the NETGEAR Support page. No workarounds are available; the only mitigation is applying the firmware update [1].