CVE-2021-45633

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker

Critical · published December 26, 2021

CVSS v3.1
9.6
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

🚨 An unauthenticated command injection vulnerability lurks in certain NETGEAR devices, giving attackers a free pass to execute commands without even breaking a sweat! 🔥 Think of it like a restaurant where anyone can just walk in and start cooking in the kitchen without any checks—potentially serving up a dangerous dish to all the patrons! This vulnerability is absolutely devastating, as an attacker could take control of your device and execute arbitrary commands, leading to data breaches or even altering device settings at will. Imagine an intruder having the keys to your network—complete chaos could ensue!

Put simply

Think of it like a restaurant where anyone can just walk in and start cooking in the kitchen without any checks—potentially serving up a dangerous dish to all the patrons! Certain NETGEAR devices, including models like CBR750 and RBK852, have a command injection flaw that allows unauthenticated users to send malicious commands to the impacted devices before fixed versions are applied.

What to do

This vulnerability is absolutely devastating, as an attacker could take control of your device and execute arbitrary commands, leading to data breaches or even altering device settings at will. Imagine an intruder having the keys to your network—complete chaos could ensue! To safeguard your network, immediately update your NETGEAR devices to the latest firmware versions: CBR750 to 4.6.3.6 and RBR750, RBR850, RBS750, RBS850, RBK752, RBK852 to 3.2.17.12 or higher. Don't delay—this is critical! You've got this! Follow these steps to lock down your devices and secure your network like the hero you are! 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AC:L/AV:A/A:H/C:H/I:H/PR:N/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.00832 · 57.2th percentile
Published
2021-12-26T00:32Z
EPSS history
Timeline
  • 26 DEC 00:32Z
    Certain NETGEAR devices are affected by command injection by an unauthenticated attacker
    cvelistv5