CVE-2021-45645

Vulnerability

A security misconfiguration exists in the firmware of multiple NETGEAR WiFi system models, including RBS50Y, SRK60, SRR60, SRS60, SXK30, SXR30, SXS30, and SRC60. Affected versions are prior to 2.7.0.122 for most models and prior to 3.2.33.108 for SXK30, SXR30, and SXS30 [1]. The exact nature of the misconfiguration is not publicly detailed, but it resides in the device's configuration settings.

Exploitation

The advisory does not specify the required attacker position or steps. However, as a security misconfiguration, exploitation likely requires network access to the affected device, possibly without authentication. No user interaction is mentioned. The specific attack vector is not disclosed.

Impact

Successful exploitation could allow an attacker to gain unauthorized access to the device or network, potentially leading to information disclosure or further compromise. The exact impact is not detailed in the advisory [1].

Mitigation

NETGEAR has released firmware updates to address this vulnerability. Users should update to firmware version 2.7.0.122 for RBS50Y, SRK60, SRR60, SRS60, and SRC60, and version 3.2.33.108 for SXK30, SXR30, and SXS30 [1]. No workarounds are provided. The advisory strongly recommends immediate updating.