NETGEAR Routers and Orbi WiFi Systems FunJSQ Vulnerability Allowing Unauthenticated Command Injection

A vulnerability in the FunJSQ module, integrated into certain NETGEAR routers and Orbi WiFi systems, allows for unauthenticated arbitrary command injection via the funjsq_access_token parameter. This issue affects several router models, including the R6230, R6260, R7000, R8900, R9000, and XR300, as well as various Orbi models. The vulnerability arises from the HTTP server exposed over the LAN interface, which can be exploited by injecting commands that are executed with root privileges.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, with the executed commands running as the root user.

Reproduction

To reproduce this vulnerability, send a request to the funjsq_httpd HTTP server on the device's LAN interface. Include the funjsq_access_token parameter, which can be generated using a hardcoded string and the device's MAC address. The injected command will be executed and can be verified by checking the device's response or logs.

Remediation

NETGEAR has released firmware updates for all affected products. Users should update to the latest firmware version available for their device model.