CVE-2021-45559
📋 TL;DR
This vulnerability allows authenticated users to execute arbitrary commands on affected NETGEAR WiFi systems. It affects RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 devices running firmware versions before 3.2.16.6. Attackers with valid credentials can inject malicious commands through vulnerable interfaces.
💻 Affected Systems
- NETGEAR RBK752
- NETGEAR RBR750
- NETGEAR RBS750
- NETGEAR RBK852
- NETGEAR RBR850
- NETGEAR RBS850
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to network takeover, data exfiltration, or use as pivot point for lateral movement within the network.
Likely Case
Local privilege escalation allowing attackers to modify device settings, intercept traffic, or install persistent backdoors.
If Mitigated
Limited impact if strong authentication controls and network segmentation prevent unauthorized access to management interfaces.
🎯 Exploit Status
Requires authenticated access to the device's web interface or API. No public exploit code available as of knowledge cutoff.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.16.6 or later
Vendor Advisory: https://kb.netgear.com/000064079/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0055
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install firmware version 3.2.16.6 or later. 4. Reboot device after update completes.
🔧 Temporary Workarounds
Restrict management access
allLimit access to device management interfaces to trusted IP addresses only
Use strong authentication
allImplement complex passwords and consider multi-factor authentication if supported
🧯 If You Can't Patch
- Segment affected devices on isolated network VLANs
- Implement strict access controls and monitor for suspicious authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Advanced > Administration > Firmware UpdateCheck Version:
Not applicable - check via web interface or mobile appVerify Fix Applied:
Confirm firmware version is 3.2.16.6 or higher in the same location📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful login
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns inconsistent with normal operation
SIEM Query:
source="netgear-router" AND (event_type="command_execution" OR event_type="config_change")