CVE-2021-27274
📋 TL;DR
This is an unauthenticated remote code execution vulnerability in NETGEAR ProSAFE Network Management System. Attackers can upload malicious files and execute arbitrary code with SYSTEM privileges without needing credentials. All installations of NMS 1.6.0.26 are affected.
💻 Affected Systems
- NETGEAR ProSAFE Network Management System (NMS300)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing attackers to install malware, steal data, pivot to other systems, or disrupt operations.
Likely Case
Attackers deploy ransomware, cryptocurrency miners, or backdoors to maintain persistent access to the network.
If Mitigated
If properly segmented and monitored, impact limited to the NMS server with potential for lateral movement detection.
🎯 Exploit Status
ZDI published detailed advisory with exploitation details. The vulnerability is actively exploited in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.7.0.5 or later
Vendor Advisory: https://kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560
Restart Required: Yes
Instructions:
1. Download the latest NMS software from NETGEAR support site. 2. Backup current configuration. 3. Run the installer to upgrade to version 1.7.0.5 or later. 4. Restart the NMS service.
🔧 Temporary Workarounds
Network Segmentation
allIsolate NMS server from internet and restrict access to trusted management networks only.
Firewall Rules
allBlock external access to NMS web interface ports (typically 80/443) at network perimeter.
🧯 If You Can't Patch
- Immediately take the NMS server offline and use alternative management methods
- Implement strict network segmentation and monitor all traffic to/from the NMS server
🔍 How to Verify
Check if Vulnerable:
Check NMS version in web interface under Help > About. If version is 1.6.0.26, system is vulnerable.Check Version:
Check web interface or examine installed program version in Windows Programs and FeaturesVerify Fix Applied:
Verify version is 1.7.0.5 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to MFileUploadController endpoint
- Unexpected SYSTEM privilege processes spawning
- Failed authentication attempts followed by successful file uploads
Network Indicators:
- HTTP POST requests to /MFileUploadController with suspicious file extensions
- Outbound connections from NMS server to unknown external IPs
SIEM Query:
source="NMS_logs" AND (uri="/MFileUploadController" OR process="cmd.exe" OR process="powershell.exe")🔗 References
- https://kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560
- https://www.zerodayinitiative.com/advisories/ZDI-21-357/
- https://kb.netgear.com/000062688/Security-Advisory-for-Pre-Authentication-Command-Injection-on-NMS300-PSV-2020-0560
- https://www.zerodayinitiative.com/advisories/ZDI-21-357/
