^{CVE-2021-45673:}Stored Cross-Site Scripting (XSS) Vulnerability in Multiple NETGEAR Router Models

Overview

This vulnerability (CVE-2021-45673) is a stored cross-site scripting (CWE-79) issue affecting several NETGEAR router models. When exploited, it allows attackers to inject and store malicious scripts on the router that execute when administrators or users access the compromised web interface. This could lead to cookie theft, credential harvesting, session hijacking, or other client-side attacks. The vulnerability affects the web management interface of the routers and requires the attacker to have some form of access to the router's configuration interface to inject the malicious payload.

Remediation

NETGEAR has released firmware updates to address this vulnerability. Users should update their router firmware to the following versions or newer:

• R7000: Update to version 1.0.11.110 or later
• R7900: Update to version 1.0.4.30 or later
• R8000: Update to version 1.0.4.62 or later
• RAX200: Update to version 1.0.3.106 or later
• R7000P: Update to version 1.3.3.140 or later
• RAX80: Update to version 1.0.3.106 or later
• R6900P: Update to version 1.3.3.140 or later
• RAX75: Update to version 1.0.3.106 or later

To update the firmware:

1. Access your router's web interface by typing its IP address in a browser
2. Log in with your administrator credentials
3. Navigate to the Administration or Advanced section
4. Look for Firmware Update or Router Update option
5. Download the appropriate firmware from NETGEAR's support site and follow the update instructions

Additionally, as a general security practice, ensure that remote administration is disabled and strong, unique passwords are used for router access.

References

1. NETGEAR Security Advisory for Stored Cross-Site Scripting: https://kb.netgear.com/000064456/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-PSV-2020-0003
2. MITRE CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html