Code Injection in NETGEAR products - CVE-2021-40847

Vulnerability identifier: #VU56818

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-40847

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the circled update daemon. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

R6700
R6900
R7900
R8000
R6400v2
R7850
R7000
R7000P
RS400
R6900P
R6700v3

Install updates from vendor's website.

R6700 - update to 1.0.2.26
R6900 - update to 1.0.2.26
R7900 - update to 1.0.4.46
R8000 - update to 1.0.4.76
R6400v2 - update to 1.0.4.120
R6700v3 - update to 1.0.4.120
R7850 - update to 1.0.5.76
R7000 - update to 1.0.11.128
R7000P - update to 1.3.3.142_HOTFIX
RS400 - update to 1.5.1.80
R6900P - update to 3.3.142_HOTFIX

• https://blog.grimm-co.com/2021/09/mama-always-told-me-not-to-trust.html
• https://kb.netgear.com/000064039/Security-Advisory-for-Remote-Code-Execution-on-Some-Routers-PSV-2021-0204

• Remote code execution in NETGEAR devices