CVE-2021-45591
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on affected NETGEAR WiFi systems. It affects RBK752, RBR750, RBS750, RBK852, RBR850, and RBS850 devices running firmware versions before 3.2.16.6. Attackers must already have valid credentials to exploit this command injection flaw.
💻 Affected Systems
- NETGEAR RBK752
- NETGEAR RBR750
- NETGEAR RBS750
- NETGEAR RBK852
- NETGEAR RBR850
- NETGEAR RBS850
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or use the device as part of a botnet.
Likely Case
Unauthorized configuration changes, network disruption, credential theft from connected devices, or installation of cryptocurrency miners.
If Mitigated
Limited to authenticated users only, reducing exposure to authorized personnel who might misuse their access.
🎯 Exploit Status
Exploitation requires valid credentials but is straightforward once authenticated. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.16.6 or later
Vendor Advisory: https://kb.netgear.com/000064113/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0099
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install firmware version 3.2.16.6 or later. 4. Reboot the device after installation completes.
🔧 Temporary Workarounds
Restrict administrative access
allLimit administrative interface access to trusted IP addresses only
Use strong unique credentials
allImplement complex passwords and avoid credential reuse to reduce risk of authenticated exploitation
🧯 If You Can't Patch
- Isolate affected devices on separate network segments with strict firewall rules
- Implement network monitoring for unusual command execution patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Advanced > Administration > Firmware UpdateCheck Version:
Not applicable - check via web interface onlyVerify Fix Applied:
Confirm firmware version shows 3.2.16.6 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful login and command execution
Network Indicators:
- Unexpected outbound connections from router
- Unusual traffic patterns from router management interface
SIEM Query:
source="router_logs" AND (command="*;*" OR command="*|*" OR command="*`*" OR command="*$(*")