CVE-2021-45628

Vulnerability

A pre-authentication command injection vulnerability exists in several NETGEAR WiFi system models. The flaw resides in the management interface and can be triggered without authentication. Affected devices include CBR40 before 2.5.0.24, CBR750 before 3.2.18.2, RBK752, RBR750, RBS750, RBK852, RBR850, RBS850 before 3.2.17.12, RBS40V before 2.6.2.4, and RBW30 before 2.6.2.2 [1].

Exploitation

An unauthenticated attacker with network access to the affected device can exploit this vulnerability by sending a specially crafted request to the management interface. No prior authentication or user interaction is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the device with elevated privileges. This can lead to full compromise of the device, including information disclosure, denial of service, or further network intrusion [1].

Mitigation

NETGEAR has released fixed firmware versions for all affected models: CBR40 to 2.5.0.24, CBR750 to 3.2.18.2, and the remaining models to 3.2.17.12 or later, with RBS40V to 2.6.2.4 and RBW30 to 2.6.2.2. Users should update to the latest firmware immediately. No workarounds are available [1].