Command Injection in NETGEAR products - #VU64832

Vulnerability identifier: #VU64832

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-77

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator on the local network can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

RAX15
RAX45
RAX20
RAX50
RAX80
RAX200
RAX75
MK62
MS60
MR60
R8000P
R7960P
CBR40
RBK752
RBK852
RBR750
RBR850
RBS750
RBS850
R7900
R8000
R6400v2
R7000
R7000P

Install updates from vendor's website.

RAX15 - update to 1.0.2.82
RAX45 - update to 1.0.2.82
RAX20 - update to 1.0.2.82
RAX50 - update to 1.0.2.82
RAX80 - update to 1.0.3.106
RAX200 - update to 1.0.3.106
RAX75 - update to 1.0.3.106
R7900 - update to 1.0.4.38
R8000 - update to 1.0.4.68
R6400v2 - update to 1.0.4.122
MK62 - update to 1.0.6.110
MS60 - update to 1.0.6.110
MR60 - update to 1.0.6.110
R7000 - update to 1.0.11.116
R7000P - update to 1.3.3.148
R8000P - update to 1.4.1.66
R7960P - update to 1.4.1.66
CBR40 - update to 2.5.0.24
RBK752 - update to 3.2.16.22
RBK852 - update to 3.2.16.22
RBR750 - update to 3.2.16.22
RBR850 - update to 3.2.16.22
RBS750 - update to 3.2.16.22
RBS850 - update to 3.2.16.22

• https://kb.netgear.com/000065029/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2020-0332

• Command Injection in NETGEAR Routers and WiFi Systems