^{CVE-2021-45556:}Command Injection Vulnerability in NETGEAR Smart Managed Pro Switches

Overview

This vulnerability (CVE-2021-45556) affects numerous NETGEAR Smart Managed Pro Switch models including GS108Tv2, GS110TPP, GS110TPv2, GS110TPv3, GS308T, GS310TP, GS724TPP, GS724TPv2, GS728TPPv2, GS728TPv2, GS752TPP, GS752TPv2, MS510TXM, and MS510TXUP. The vulnerability is a command injection flaw that allows an authenticated attacker to execute arbitrary system commands with elevated privileges on the affected device. Since this is a post-authentication vulnerability, an attacker must first have valid credentials to the device's management interface. Once authenticated, the attacker could exploit this vulnerability to gain control over the device, potentially leading to network compromise, data theft, or use of the device as a pivot point for further attacks.

Remediation

To address this vulnerability, NETGEAR has released firmware updates for all affected devices. Users should update to the following minimum firmware versions:

• GS108Tv2: Update to version 5.4.2.36 or later
• GS110TPP: Update to version 7.0.7.2 or later
• GS110TPv2: Update to version 5.4.2.36 or later
• GS110TPv3: Update to version 7.0.7.2 or later
• GS308T: Update to version 1.0.3.2 or later
• GS310TP: Update to version 1.0.3.2 or later
• GS724TPP: Update to version 2.0.6.3 or later
• GS724TPv2: Update to version 2.0.6.3 or later
• GS728TPPv2: Update to version 6.0.8.2 or later
• GS728TPv2: Update to version 6.0.8.2 or later
• GS752TPP: Update to version 6.0.8.2 or later
• GS752TPv2: Update to version 6.0.8.2 or later
• MS510TXM: Update to version 1.0.4.2 or later
• MS510TXUP: Update to version 1.0.4.2 or later

Additionally, implement the following security best practices:

1. Change default administrator credentials
2. Restrict management access to trusted IP addresses
3. Use strong, unique passwords for device administration
4. If possible, implement network segmentation to isolate management interfaces
5. Regularly check for and apply firmware updates

References

1. NETGEAR Security Advisory for Post-Authentication Command Injection on Some Smart Managed Pro Switches (PSV-2021-0175): https://kb.netgear.com/000064534/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Smart-Managed-Pro-Switches-PSV-2021-0175
2. Common Weakness Enumeration: CWE-77 (Improper Neutralization of Special Elements used in a Command): https://cwe.mitre.org/data/definitions/77.html