CVE-2021-45632

Vulnerability

A pre-authentication command injection vulnerability exists in several NETGEAR WiFi system models. The flaw resides in the firmware of the affected devices and can be triggered without any authentication. Affected models include CBR750 (firmware before 4.6.3.6), RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 (all firmware before 3.2.17.12). An unauthenticated attacker can exploit this vulnerability over the network [1].

Exploitation

An attacker with network access to the affected device can send specially crafted requests to the management interface to inject arbitrary commands. No authentication or user interaction is required. The exact attack vector is not detailed in the advisory, but the vulnerability is classified as pre-authentication command injection [1].

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands with root privileges on the device. This can lead to full compromise of the WiFi system, including information disclosure, denial of service, or use as a pivot for further attacks on the network [1].

Mitigation

NETGEAR has released fixed firmware versions: CBR750 upgrade to 4.6.3.6; all other models upgrade to 3.2.17.12. The advisory was published on 2021-09-26. No workarounds are available; users are strongly advised to update their firmware immediately [1].