CVE-2021-45575
📋 TL;DR
This vulnerability allows authenticated users on certain NETGEAR WiFi systems to execute arbitrary commands through command injection. It affects RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 devices running firmware versions before 3.2.16.6.
💻 Affected Systems
- NETGEAR RBK752
- NETGEAR RBR750
- NETGEAR RBS750
- NETGEAR RBK852
- NETGEAR RBR850
- NETGEAR RBS850
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or brick the device.
Likely Case
Attacker with valid credentials gains elevated privileges to modify device configuration, steal credentials, or launch attacks against internal systems.
If Mitigated
Limited to authenticated users only, so impact is reduced if strong authentication and access controls are implemented.
🎯 Exploit Status
Exploitation requires valid credentials. The vulnerability is in post-authentication functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.16.6 or later
Vendor Advisory: https://kb.netgear.com/000064097/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0083
Restart Required: Yes
Instructions:
1. Log into NETGEAR router admin interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install firmware version 3.2.16.6 or later. 4. Reboot the device after update completes.
🔧 Temporary Workarounds
Restrict Admin Access
allLimit administrative access to trusted IP addresses only
Strong Authentication
allImplement complex passwords and consider multi-factor authentication if supported
🧯 If You Can't Patch
- Isolate affected devices on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under Advanced > Administration > Firmware UpdateCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Confirm firmware version is 3.2.16.6 or later in the admin interface📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns indicating command execution
SIEM Query:
source="netgear-router" AND (event_type="command_execution" OR event_type="system_modification")