CVE-2022-37337
📋 TL;DR
This CVE describes a command injection vulnerability in Netgear Orbi RBR750 routers running firmware version 4.6.8.5. An authenticated attacker can send specially crafted HTTP requests to execute arbitrary commands on the router with root privileges. This affects users of Netgear Orbi RBR750 systems with the vulnerable firmware.
💻 Affected Systems
- Netgear Orbi RBR750
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing persistent backdoor installation, network traffic interception, lateral movement to connected devices, and router bricking.
Likely Case
Router takeover leading to DNS hijacking, credential theft from network traffic, and installation of malware on connected devices.
If Mitigated
Limited impact if proper network segmentation and authentication controls prevent attacker access to the router's admin interface.
🎯 Exploit Status
Exploitation requires valid credentials but is straightforward once authenticated. Public technical details available in Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 4.6.8.6 and later
Vendor Advisory: https://kb.netgear.com/000065417/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0187
Restart Required: Yes
Instructions:
1. Log into Orbi web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates and install firmware 4.6.8.6 or later. 4. Reboot router after update completes.
🔧 Temporary Workarounds
Disable remote management
allPrevent external access to router admin interface
Change default credentials
allUse strong unique passwords for router admin account
🧯 If You Can't Patch
- Isolate router on separate VLAN with strict firewall rules
- Implement network monitoring for suspicious HTTP requests to router admin interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Advanced > Administration > Firmware UpdateCheck Version:
curl -s http://router_ip/debug_info.htm | grep FirmwareVerify Fix Applied:
Confirm firmware version is 4.6.8.6 or higher in router admin interface📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to router admin endpoints
- Multiple failed login attempts followed by successful authentication
Network Indicators:
- HTTP requests with shell metacharacters in parameters
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (url="*cgi-bin*" OR url="*debug*" OR url="*RST*statistics*htm") AND (method="POST" OR method="GET") AND (param="*;*" OR param="*|*" OR param="*`*" OR param="*$(*")🔗 References
- https://kb.netgear.com/000065417/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0187
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1596
- https://kb.netgear.com/000065417/Security-Advisory-for-Command-Injection-on-Some-Orbi-WiFi-Systems-PSV-2022-0187
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1596
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1596
