Remote Code Execution Vulnerability in NETGEAR Routers via Circle Parental Control Service

CVE-2021-40847

Summary

The Circle Parental Control Service on various NETGEAR routers has a vulnerability in its update process that allows remote attackers to execute arbitrary code. This issue arises from the circumvention of security measures, as the update mechanism relies on cleartext HTTP for version checks and database updates. Attackers capable of performing a Man-in-the-Middle (MitM) attack can intercept these requests, supplying malicious payloads disguised as legitimate updates. This exploitation can lead to the overwriting of critical executable files with unauthorized code, significantly compromising device integrity. Although the parental control feature is not enabled by default, the update daemon is on, thereby increasing the susceptibility of these routers to exploitation.

References