CVE-2021-27276
📋 TL;DR
This vulnerability in NETGEAR ProSAFE Network Management System allows authenticated attackers to bypass authentication and delete arbitrary files via path traversal in the realName parameter. It affects NETGEAR NMS300 installations, potentially causing denial-of-service by deleting critical system files. Attackers with network access to the management interface can exploit this.
💻 Affected Systems
- NETGEAR ProSAFE Network Management System 300 (NMS300)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical operating system files, rendering the device inoperable and requiring physical restoration.
Likely Case
Denial-of-service by deleting configuration files or application components, disrupting network management capabilities.
If Mitigated
Limited impact with proper network segmentation and authentication controls, though authentication bypass makes this challenging.
🎯 Exploit Status
Authentication bypass exists, making exploitation straightforward once the vulnerability is understood. ZDI published advisory with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.7.0.22 or later
Vendor Advisory: https://kb.netgear.com/000062722/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0500
Restart Required: Yes
Instructions:
1. Download the latest firmware from NETGEAR support site. 2. Backup current configuration. 3. Apply firmware update through web interface. 4. Reboot the appliance. 5. Verify version is 1.7.0.22 or higher.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to NMS300 management interface to trusted administrative networks only.
Configure firewall rules to allow only specific IP ranges to access NMS300 web interface (typically port 80/443)
Authentication Hardening
allImplement additional authentication layers or IP-based restrictions.
Configure web server to require client certificate authentication or implement reverse proxy with additional auth
🧯 If You Can't Patch
- Isolate the NMS300 appliance on a dedicated management VLAN with strict firewall rules
- Implement network monitoring for unusual file deletion patterns or authentication bypass attempts
🔍 How to Verify
Check if Vulnerable:
Check web interface login page for version information, or SSH into appliance and check version files.Check Version:
ssh admin@nms-ip 'cat /etc/version' or check web interface → System → AboutVerify Fix Applied:
Verify version is 1.7.0.22 or higher in web interface or via SSH version check.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in system logs
- Authentication bypass attempts in web server logs
- Multiple failed login attempts followed by successful access
Network Indicators:
- HTTP POST requests to MibController with path traversal patterns in realName parameter
- Unusual file deletion operations from NMS300 IP
SIEM Query:
source="nms300_logs" AND (event="file_deletion" OR param="realName" AND value CONTAINS "../")🔗 References
- https://kb.netgear.com/000062722/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0500
- https://www.zerodayinitiative.com/advisories/ZDI-21-359/
- https://kb.netgear.com/000062722/Security-Advisory-for-Denial-of-Service-on-NMS300-PSV-2020-0500
- https://www.zerodayinitiative.com/advisories/ZDI-21-359/
