CVE-2021-37565
📋 TL;DR
This vulnerability in MediaTek Wi-Fi chipsets allows attackers to perform out-of-bounds reads via IEEE 1905 protocol handling. It affects NETGEAR and other devices using specified MediaTek chipsets. Successful exploitation could lead to information disclosure or system crashes.
💻 Affected Systems
- NETGEAR devices with MediaTek chipsets
- Other devices using affected MediaTek chipsets
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, though out-of-bounds read typically enables information disclosure or denial of service.
Likely Case
Information disclosure of kernel memory or device crash/reboot causing denial of service.
If Mitigated
Limited impact with proper network segmentation and updated firmware.
🎯 Exploit Status
Exploitation requires sending specially crafted IEEE 1905 protocol packets to vulnerable devices.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.0.2
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/January-2022
Restart Required: Yes
Instructions:
1. Check device model and current firmware version. 2. Download latest firmware from vendor website. 3. Apply firmware update via device web interface or management tool. 4. Reboot device after update.
🔧 Temporary Workarounds
Disable IEEE 1905 protocol
allIf supported, disable IEEE 1905 protocol handling on affected devices
Network segmentation
allIsolate affected devices from untrusted networks
🧯 If You Can't Patch
- Segment affected devices on isolated VLANs
- Implement network monitoring for anomalous IEEE 1905 traffic
🔍 How to Verify
Check if Vulnerable:
Check device firmware version and chipset model. If using affected MediaTek chipsets with firmware ≤2.0.2, device is vulnerable.Check Version:
Check via device web interface under Administration or System Status, or use vendor-specific CLI commands.Verify Fix Applied:
Verify firmware version is updated beyond 2.0.2 and check vendor patch notes.📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Kernel panic logs
- Memory access violation errors
Network Indicators:
- Anomalous IEEE 1905 protocol traffic
- Unexpected packets to Wi-Fi management interfaces
SIEM Query:
Search for: device_model IN (affected_models) AND (event_type='crash' OR event_type='reboot') OR protocol='IEEE1905' AND anomaly_score>threshold🔗 References
- https://corp.mediatek.com/product-security-bulletin/January-2022
- https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300
- https://corp.mediatek.com/product-security-bulletin/January-2022
- https://kb.netgear.com/000064368/Security-Advisory-for-WiFi-WPS-and-IEEE-1905-Vulnerabilities-on-Multiple-Products-PSV-2021-0298-PSV-2021-0300
