Command Injection in NETGEAR products - #VU73743

Vulnerability identifier: #VU73743

CSH Severity: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: N/A

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
CBR750
LAX20
MK62
MR60
MS60
MK83
MR80
MS80
NBR750
R7960P
R8000P
RAX15
RAX20
RAX200
RAX35v2
RAX38v2
RAX40v2
RAX42
RAX43
RAX45
RAX48
RAX50
RAX50S
RAX75
RAX80
RAXE450
RAXE500
RBK752
RBR750
RBS750
RBK840
RBR840
RBS840
RBK852
RBR850
RBS850
RBKE962
RBRE960
RBSE960
XR1000

Software vendor:
NETGEAR

The vulnerability allows a remote user to execute arbitrary commands on the target system.

The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://kb.netgear.com/000065574/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-WiFi-Systems-PSV-2021-0182