CVE-2021-38518
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on affected NETGEAR routers and WiFi systems. It affects specific NETGEAR models running outdated firmware versions. Attackers must first authenticate to the device's web interface before exploiting this command injection flaw.
💻 Affected Systems
- NETGEAR RAX200
- NETGEAR RAX75
- NETGEAR RAX80
- NETGEAR RBK852
- NETGEAR RBR850
- NETGEAR RBS850
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, intercept all network traffic, pivot to internal networks, or brick the device.
Likely Case
Local network compromise enabling attackers to modify router settings, intercept traffic, or use the router as a foothold for further attacks.
If Mitigated
Limited impact if strong authentication controls prevent unauthorized access and network segmentation isolates the router.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authentication is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RAX200/RAX75/RAX80: 1.0.4.120 or later; RBK852/RBR850/RBS850: 3.2.17.12 or later
Vendor Advisory: https://kb.netgear.com/000063783/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2020-0528
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install latest firmware. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Change default credentials
allChange router admin password from default to strong unique password
Disable remote management
allDisable remote administration features to prevent external access
🧯 If You Can't Patch
- Implement network segmentation to isolate router management interface
- Enable logging and monitor for suspicious authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Advanced > Administration > Firmware UpdateCheck Version:
Check via web interface or SSH if enabled: cat /etc/versionVerify Fix Applied:
Verify firmware version shows 1.0.4.120 or later for RAX models, or 3.2.17.12 or later for RBK/RBR/RBS models📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Command execution patterns in system logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unusual outbound connections from router
- Traffic redirection patterns
- DNS changes from router
SIEM Query:
source="router_logs" AND (event="authentication" AND result="success") AND (user="admin" OR user="root") AND (src_ip NOT IN [trusted_management_ips])