CVE-2021-38530: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2.5.1.16, RB...

Summary

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2.5.1.16, RBR20 before 2.5.1.16, RBS20 before 2.5.1.16, RBK50 before 2.5.1.16, RBR50 before 2.5.1.16, RBS50 before ...

What to do

Update netgear rbk40_firmware to version 2.5.1.16 or later.
Update netgear rbr40_firmware to version 2.5.1.16 or later.
Update netgear rbs40_firmware to version 2.5.1.16 or later.
Update netgear rbk20_firmware to version 2.5.1.16 or later.
Update netgear rbr20_firmware to version 2.5.1.16 or later.
Update netgear rbs20_firmware to version 2.5.1.16 or later.
Update netgear rbk50_firmware to version 2.5.1.16 or later.
Update netgear rbr50_firmware to version 2.5.1.16 or later.
Update netgear rbs50_firmware to version 2.5.1.16 or later.
Update netgear rbs50y_firmware to version 2.6.1.40 or later.

Affected software

Vendor	Product	Affected versions
netgear	rbk40_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbk40_firmware::::::::`
netgear	rbr40_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbr40_firmware::::::::`
netgear	rbs40_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbs40_firmware::::::::`
netgear	rbk20_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbk20_firmware::::::::`
netgear	rbr20_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbr20_firmware::::::::`
netgear	rbs20_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbs20_firmware::::::::`
netgear	rbk50_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbk50_firmware::::::::`
netgear	rbr50_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbr50_firmware::::::::`
netgear	rbs50_firmware	< 2.5.1.16 `cpe:2.3:o:netgear:rbs50_firmware::::::::`
netgear	rbs50y_firmware	< 2.6.1.40 `cpe:2.3:o:netgear:rbs50y_firmware::::::::`

Original advisory text

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2.5.1.16, RB...

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2.5.1.16, RBR20 before 2.5.1.16, RBS20 before 2.5.1.16, RBK50 before 2.5.1.16, RBR50 before 2.5.1.16, RBS50 before 2.5.1.16, and RBS50Y before 2.6.1.40.

References

https://kb.netgear.com/000063770/Security-Advisory-for-Pre-Authentication-Comman... Vendor Advisory