CVE-2021-37563
📋 TL;DR
This vulnerability in MediaTek Wi-Fi chipsets allows attackers to execute arbitrary code or cause denial of service via an out-of-bounds write during WPS protocol handling. It affects NETGEAR and other devices using specified MediaTek chipsets with firmware version 7.4.0.0. The vulnerability requires proximity to the wireless network but can be exploited without authentication.
💻 Affected Systems
- NETGEAR routers and access points with MediaTek chipsets
- Other devices using affected MediaTek chipsets
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and persistent backdoor installation.
Likely Case
Denial of service causing Wi-Fi disruption, potential device crash/reboot, and limited information disclosure.
If Mitigated
No impact if WPS is disabled or devices are patched; otherwise, denial of service remains possible.
🎯 Exploit Status
Exploitation requires proximity to wireless network and WPS protocol knowledge. No public exploit code available as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor-specific firmware updates (NETGEAR released patches in January 2022)
Vendor Advisory: https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300
Restart Required: Yes
Instructions:
1. Check NETGEAR support site for your device model. 2. Download latest firmware. 3. Upload via web interface. 4. Reboot device. 5. Verify firmware version updated.
🔧 Temporary Workarounds
Disable WPS
allTurn off Wi-Fi Protected Setup feature to prevent exploitation
Network segmentation
allIsolate affected devices on separate VLANs to limit potential impact
🧯 If You Can't Patch
- Disable WPS immediately in device administration interface
- Implement network monitoring for WPS protocol anomalies and device crashes
🔍 How to Verify
Check if Vulnerable:
Check device firmware version and WPS status in administration interface. If firmware is 7.4.0.0 and WPS enabled, device is vulnerable.Check Version:
Device-specific; typically via web interface at Status > Firmware or using CLI commands for advanced devicesVerify Fix Applied:
Verify firmware version is updated beyond 7.4.0.0 and check vendor patch notes for CVE-2021-37563 inclusion.📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- WPS protocol errors
- Memory corruption warnings in system logs
Network Indicators:
- Abnormal WPS protocol traffic patterns
- Multiple WPS connection attempts from single source
SIEM Query:
Search for: (device_type:router OR device_type:ap) AND (event:"WPS error" OR event:"memory corruption" OR event:"unexpected reboot")🔗 References
- https://corp.mediatek.com/product-security-bulletin/January-2022
- https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300
- https://corp.mediatek.com/product-security-bulletin/January-2022
- https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300
