CVE-2021-45678
📋 TL;DR
NETGEAR RAX200 routers running firmware before version 1.0.5.132 contain insecure code that could allow remote attackers to execute arbitrary commands or take control of the device. This affects all users of these routers who haven't updated to the patched firmware. The vulnerability is particularly dangerous because it can be exploited without authentication.
💻 Affected Systems
- NETGEAR RAX200 Nighthawk Tri-Band WiFi 6 Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attacker to intercept all network traffic, install malware on connected devices, pivot to internal networks, and maintain persistent access.
Likely Case
Remote code execution leading to router compromise, DNS hijacking, credential theft from network traffic, and potential ransomware deployment.
If Mitigated
Limited impact with proper network segmentation, but still potential for router compromise affecting all connected devices.
🎯 Exploit Status
While no public PoC exists, the high CVSS score and unauthenticated nature make weaponization likely. Attackers can exploit this without any credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.5.132 or later
Vendor Advisory: https://kb.netgear.com/000064171/Security-Advisory-for-Updates-on-the-RAX200-PSV-2021-0192
Restart Required: Yes
Instructions:
1. Log into router admin interface (typically 192.168.1.1 or routerlogin.net). 2. Navigate to Advanced > Administration > Firmware Update. 3. Click 'Check' for updates. 4. If update to 1.0.5.132 or later is available, click 'Yes' to install. 5. Wait for router to reboot (approximately 5-10 minutes).
🔧 Temporary Workarounds
Disable Remote Management
allPrevents external attackers from accessing router management interface
Network Segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace vulnerable device with patched or different model
- Place router behind firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under Advanced > Administration > Firmware UpdateCheck Version:
Not applicable - check via web interface at 192.168.1.1 or routerlogin.netVerify Fix Applied:
Confirm firmware version shows 1.0.5.132 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts to router
- Unexpected configuration changes
- Unknown processes running on router
Network Indicators:
- Unusual outbound connections from router
- DNS queries to suspicious domains
- Port scans originating from router
SIEM Query:
source="router" AND (event_type="config_change" OR event_type="auth_failure")