CVE-2021-45586

Vulnerability

A post-authentication command injection vulnerability exists in the web management interface of certain NETGEAR WiFi system models. Affected devices include RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 running firmware versions prior to 3.2.16.6. An authenticated user can inject arbitrary operating system commands through a crafted request, leading to full system compromise [1].

Exploitation

An attacker must first obtain valid credentials for the device's administrative interface. Once authenticated, the attacker sends a specially crafted HTTP request to a vulnerable endpoint, injecting commands that are executed with root privileges. The exact injection point and required parameters have not been publicly disclosed in the available reference [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system as the root user. This can lead to complete disclosure of sensitive data, modification of device configuration, installation of persistent malware, and denial of service. The attacker gains full control over the affected WiFi system [1].

Mitigation

NETGEAR has released firmware version 3.2.16.6 to address this vulnerability. Users should update their devices to this version or later immediately via the NETGEAR Support page. No workarounds are available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].