CVE-2021-45598

Vulnerability

This is a post-authentication command injection vulnerability affecting NETGEAR WiFi system models: CBR40 (before firmware version 2.5.0.24), CBR750 (before 4.6.3.6), RBK852, RBR850, and RBS850 (all before 3.2.17.12). The vulnerability exists in the firmware and can be exploited by an authenticated user to inject arbitrary commands [1].

Exploitation

An attacker must have valid credentials to the device's administrative interface. No user interaction is required beyond authentication. The attacker can send specially crafted input to inject commands. The CVSS vector indicates network adjacency (AV:A) and high privileges required (PR:H), meaning the attacker needs authenticated access [1].

Impact

Successful exploitation allows an attacker to execute arbitrary commands with root privileges, leading to full compromise of confidentiality, integrity, and availability. The scope is changed, meaning the attacker can affect resources beyond the vulnerable component [1].

Mitigation

NETGEAR has released fixed firmware versions: CBR40 2.5.0.24, CBR750 4.6.3.6, RBK852/RBR850/RBS850 3.2.17.12. Users should update to these versions via NETGEAR Support. No workarounds are provided. The vulnerability is not listed in CISA KEV as of the publication date [1].