CVE-2021-45587
📋 TL;DR
This vulnerability allows authenticated users to execute arbitrary commands on affected NETGEAR WiFi systems through command injection. It affects specific NETGEAR Orbi mesh WiFi systems (RBK/RBR/RBS 750 and 850 series) running firmware versions before 3.2.16.6.
💻 Affected Systems
- NETGEAR RBK752
- NETGEAR RBR750
- NETGEAR RBS750
- NETGEAR RBK852
- NETGEAR RBR850
- NETGEAR RBS850
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could gain full control of the device, pivot to internal networks, install persistent backdoors, or use the device as a launch point for further attacks.
Likely Case
Malicious insiders or compromised accounts could execute commands to disrupt network services, steal credentials, or deploy malware on the local network.
If Mitigated
With proper access controls and network segmentation, impact would be limited to the affected device only, preventing lateral movement.
🎯 Exploit Status
Exploitation requires valid credentials but is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.16.6 or later
Vendor Advisory: https://kb.netgear.com/000064109/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0095
Restart Required: Yes
Instructions:
1. Log into the router's web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install firmware version 3.2.16.6 or later. 4. The device will reboot automatically.
🔧 Temporary Workarounds
Restrict administrative access
allLimit administrative access to trusted IP addresses only and use strong, unique passwords.
Network segmentation
allPlace affected devices in isolated network segments to limit potential lateral movement.
🧯 If You Can't Patch
- Implement strict access controls and monitor administrative login attempts
- Consider replacing affected devices with patched models if updates cannot be applied
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Advanced > Administration > Firmware UpdateCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Confirm firmware version is 3.2.16.6 or later in the same location📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- Unexpected outbound connections from router
- Unusual traffic patterns from router IP
SIEM Query:
source="router_logs" AND (event="command_execution" OR event="shell_access")