CVE-2021-45633

Vulnerability

A pre-authentication command injection vulnerability exists in several NETGEAR WiFi system models. The flaw resides in the firmware of the affected devices, allowing an unauthenticated attacker to inject arbitrary commands. Affected models and fixed firmware versions are: CBR750 before 4.6.3.6, RBR750, RBR850, RBS750, RBS850, RBK752, and RBK852 all before 3.2.17.12 [1].

Exploitation

An attacker can exploit this vulnerability without any prior authentication or network access credentials. The attack vector is remote, requiring only network connectivity to the affected device. The exact exploitation steps are not publicly detailed, but the advisory confirms that the command injection occurs before authentication, meaning no user interaction or special privileges are needed [1].

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the device with elevated privileges. This can lead to full compromise of the device, including disclosure of sensitive information, modification of device configuration, and potential use as a pivot point for further network attacks [1].

Mitigation

NETGEAR has released fixed firmware versions for all affected models: CBR750 firmware version 4.6.3.6, and for the other models firmware version 3.2.17.12. Users are strongly advised to download and install the latest firmware from NETGEAR Support as soon as possible. No workarounds are provided; updating to the patched firmware is the only mitigation [1].