CVE-2024-35520
📋 TL;DR
This vulnerability allows authenticated attackers to execute arbitrary commands on Netgear R7000 routers by injecting malicious input into the device_name2 parameter of the RMT_invite.cgi script. Attackers who gain access to the router's web interface can achieve remote code execution. This affects Netgear R7000 routers running firmware version 1.0.11.136.
💻 Affected Systems
- Netgear R7000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attacker to intercept all network traffic, install persistent backdoors, pivot to internal network devices, and use router as botnet node.
Likely Case
Attacker with router credentials executes commands to steal credentials, modify DNS settings, or deploy malware to connected devices.
If Mitigated
Limited impact if strong authentication is used and router is isolated from critical systems.
🎯 Exploit Status
Post-authentication command injection with clear parameter. Exploitation is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.11.136_10.2.123 or later
Vendor Advisory: https://kb.netgear.com/000066027/Security-Advisory-for-Post-Authentication-Command-Injection-on-the-R7000-PSV-2023-0154
Restart Required: Yes
Instructions:
1. Log into router web interface. 2. Navigate to Advanced > Administration > Firmware Update. 3. Check for updates. 4. Download and install latest firmware. 5. Reboot router after installation.
🔧 Temporary Workarounds
Disable Remote Management
allPrevents external access to web interface
Change Default Credentials
allUse strong unique password for router admin
🧯 If You Can't Patch
- Isolate router on separate VLAN from critical systems
- Implement network monitoring for suspicious outbound connections from router
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface under Advanced > Administration > Firmware UpdateCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version is 1.0.11.136_10.2.123 or later📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in router logs
- Multiple failed login attempts followed by successful login
Network Indicators:
- Router making unexpected outbound connections
- DNS queries to suspicious domains from router
SIEM Query:
source="router" AND (event="command_execution" OR event="rmt_invite")