CVE-2021-45629

Vulnerability

A pre-authentication command injection vulnerability exists in the web management interface of several NETGEAR WiFi system models. The flaw allows an unauthenticated attacker to inject arbitrary operating system commands. Affected models include CBR750 (before firmware version 4.6.3.6), RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 (all before firmware version 3.2.17.12) [1].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the device's management interface without requiring any authentication. The attacker must have network access to the device, either from the local LAN or from the WAN if remote management is enabled. No user interaction is needed [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with elevated privileges, likely root. This can lead to full compromise of the device, including data exfiltration, installation of malware, or use in further network attacks [1].

Mitigation

NETGEAR has released fixed firmware versions: CBR750 firmware version 4.6.3.6, and for all other listed models firmware version 3.2.17.12. Users should update to these versions immediately via the NETGEAR Support page. No workarounds are available [1].