CVE-2021-37561
📋 TL;DR
This vulnerability in MediaTek Wi-Fi chipsets allows attackers to execute arbitrary code via an out-of-bounds write in the WPS protocol implementation. Affected devices include NETGEAR routers and other products using specified MediaTek chipsets. The vulnerability requires proximity to the wireless network but can lead to complete device compromise.
💻 Affected Systems
- NETGEAR routers with MediaTek chipsets
- Other devices using affected MediaTek chipsets
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full device compromise, persistence, network pivoting, and data interception
Likely Case
Device takeover enabling network monitoring, credential theft, and botnet recruitment
If Mitigated
Limited impact if WPS is disabled and proper network segmentation is implemented
🎯 Exploit Status
Exploitation requires wireless proximity and WPS protocol interaction
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor-specific firmware updates
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/January-2022
Restart Required: Yes
Instructions:
1. Check NETGEAR or device manufacturer website for firmware updates. 2. Download latest firmware for your model. 3. Upload via device admin interface. 4. Reboot device.
🔧 Temporary Workarounds
Disable WPS
allTurn off Wi-Fi Protected Setup feature on affected devices
Network Segmentation
allIsolate affected devices from critical network segments
🧯 If You Can't Patch
- Disable WPS functionality immediately
- Replace affected devices with non-MediaTek alternatives
🔍 How to Verify
Check if Vulnerable:
Check device model and firmware version against vendor advisoriesCheck Version:
Check device admin interface or use vendor-specific CLI commandsVerify Fix Applied:
Verify firmware version is updated beyond vulnerable version and WPS is disabled📡 Detection & Monitoring
Log Indicators:
- Unusual WPS protocol activity
- Multiple failed WPS connection attempts
- Firmware modification logs
Network Indicators:
- Abnormal WPS traffic patterns
- Unexpected device reboots
- Suspicious outbound connections from router
SIEM Query:
device_type:router AND (event_type:wps_anomaly OR firmware_change)🔗 References
- https://corp.mediatek.com/product-security-bulletin/January-2022
- https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300
- https://corp.mediatek.com/product-security-bulletin/January-2022
- https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300
