CVE-2021-45537
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on affected NETGEAR routers and WiFi systems. It affects multiple NETGEAR models including RAX200, RAX75, RAX80, RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850. Attackers must first authenticate to the device's web interface before exploiting the command injection flaw.
💻 Affected Systems
- NETGEAR RAX200
- NETGEAR RAX75
- NETGEAR RAX80
- NETGEAR RBK752
- NETGEAR RBR750
- NETGEAR RBS750
- NETGEAR RBK852
- NETGEAR RBR850
- NETGEAR RBS850
📦 What is this software?
Rbk752 by Netgear
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or use the device as part of a botnet.
Likely Case
Local network compromise where attackers gain control of the router to modify DNS settings, intercept traffic, or launch attacks against internal devices.
If Mitigated
Limited impact if strong authentication is used and network segmentation isolates the router management interface.
🎯 Exploit Status
Exploitation requires authenticated access to the web interface. The vulnerability is in the command injection mechanism (CWE-77) which typically involves injecting shell commands through web parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: RAX200, RAX75, RAX80: 1.0.3.106 or later; RBK752, RBR750, RBS750, RBK852, RBR850, RBS850: 3.2.16.6 or later
Vendor Advisory: https://kb.netgear.com/000064083/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2020-0061
Restart Required: Yes
Instructions:
1. Log into NETGEAR router web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install if available. 4. Alternatively, download firmware from NETGEAR support site and manually upload. 5. Reboot device after update.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router management interface
Change default credentials
allUse strong, unique passwords for router admin access
🧯 If You Can't Patch
- Isolate router management interface to trusted network segments only
- Implement network monitoring for suspicious router configuration changes
🔍 How to Verify
Check if Vulnerable:
Log into router web interface and check firmware version under Advanced > Administration > Firmware UpdateCheck Version:
Check via web interface or use curl: curl -u admin:password http://router_ip/currentsetting.htm | grep firmwareVerify Fix Applied:
Confirm firmware version is RAX models: 1.0.3.106 or higher, Orbi models: 3.2.16.6 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in router logs
- Multiple failed login attempts followed by configuration changes
- Unexpected firmware or configuration modifications
Network Indicators:
- Unusual outbound connections from router
- DNS configuration changes
- New port openings on router
SIEM Query:
source="router_logs" AND ("command injection" OR "shell" OR "exec" OR suspicious configuration changes)