CVE-2021-31802
📋 TL;DR
This vulnerability allows unauthenticated attackers on the local network to execute arbitrary code with root privileges on NETGEAR R7000 routers. It's a heap-based buffer overflow in the HTTP request handler during backup.cgi file uploads. Only NETGEAR R7000 devices running specific vulnerable firmware are affected.
💻 Affected Systems
- NETGEAR Nighthawk R7000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains complete root control of the router, enabling traffic interception, credential theft, network pivoting, and persistent backdoor installation.
Likely Case
Local network attacker compromises the router to intercept traffic, modify DNS settings, or use it as a foothold for attacking other devices on the network.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself without lateral movement to other systems.
🎯 Exploit Status
Exploit requires adding \n before Content-Length header in HTTP request. Public exploit code exists and is relatively simple to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after 1.0.11.116
Vendor Advisory: https://www.netgear.com/about/security/
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install latest firmware. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable remote management
allPrevents HTTP access to router management interface from local network
Network segmentation
allIsolate router management interface to trusted VLAN or segment
🧯 If You Can't Patch
- Replace router with updated model or different vendor
- Implement strict network access controls to limit who can reach router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under Advanced > Administration > Firmware UpdateCheck Version:
curl -s http://routerlogin.com/currentsetting.htm | grep firmwareVerify Fix Applied:
Verify firmware version is newer than 1.0.11.116 and attempt to reproduce exploit with test payload📡 Detection & Monitoring
Log Indicators:
- HTTP requests to backup.cgi with malformed Content-Length headers
- Unusual process execution from httpd service
Network Indicators:
- HTTP POST requests to /backup.cgi containing \n before Content-Length
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/backup.cgi" OR process="httpd") AND (header="Content-Length" AND content="\\n")