CVE-2021-27273
📋 TL;DR
This vulnerability allows authenticated remote attackers to execute arbitrary operating system commands on NETGEAR ProSAFE Network Management System installations. Attackers can bypass authentication mechanisms and exploit improper input validation in the fileName parameter to achieve SYSTEM-level code execution. Organizations using NETGEAR NMS 1.6.0.26 are affected.
💻 Affected Systems
- NETGEAR ProSAFE Network Management System (NMS300)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install malware, exfiltrate data, pivot to other systems, or disrupt network operations.
Likely Case
Unauthorized command execution leading to data theft, network reconnaissance, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper network segmentation, authentication hardening, and input validation are implemented.
🎯 Exploit Status
Authentication bypass combined with command injection makes exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.0.27 or later
Vendor Advisory: https://kb.netgear.com/000062686/Security-Advisory-for-Post-Authentication-Command-Injection-on-NMS300-PSV-2020-0559
Restart Required: Yes
Instructions:
1. Download the latest firmware from NETGEAR support site. 2. Log into NMS web interface. 3. Navigate to Administration > Maintenance > Firmware Upgrade. 4. Upload the firmware file and follow upgrade prompts. 5. System will reboot automatically.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to NMS management interface to trusted IP addresses only.
Authentication Hardening
allImplement strong authentication policies, multi-factor authentication if possible, and monitor for authentication bypass attempts.
🧯 If You Can't Patch
- Isolate the NMS system on a dedicated management VLAN with strict firewall rules
- Implement network-based intrusion detection/prevention systems to monitor for command injection patterns
🔍 How to Verify
Check if Vulnerable:
Check the NMS web interface login page or system information for version 1.6.0.26.Check Version:
Not applicable - check via web interface at https://[nms-ip]:8443/login.jspVerify Fix Applied:
Verify the firmware version shows 1.6.0.27 or later in the Administration > Maintenance > Firmware Upgrade section.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Unexpected system command execution logs
- File operations with suspicious parameters in fileName
Network Indicators:
- HTTP POST requests to /SettingConfigController with unusual fileName parameters
- Outbound connections from NMS to unexpected destinations
SIEM Query:
source="nms_logs" AND ("SettingConfigController" OR "fileName" OR "command injection")🔗 References
- https://kb.netgear.com/000062686/Security-Advisory-for-Post-Authentication-Command-Injection-on-NMS300-PSV-2020-0559
- https://www.zerodayinitiative.com/advisories/ZDI-21-356/
- https://kb.netgear.com/000062686/Security-Advisory-for-Post-Authentication-Command-Injection-on-NMS300-PSV-2020-0559
- https://www.zerodayinitiative.com/advisories/ZDI-21-356/
