NETGEAR Orbi Devices DHCPv6 Command Injection Vulnerability

A vulnerability allowing OS command injection has been identified in NETGEAR Orbi devices, specifically within the DHCPv6 functionality. This issue arises from insufficient input validation, which allows network-adjacent attackers authenticated over WiFi or on the local area network to execute arbitrary commands on the router. It's important to note that DHCPv6 is not enabled by default on these devices.

Impact

Exploitation of this vulnerability allows for OS command injection on the affected router.

Remediation

Users can manually check their device's firmware version and update it to the latest version. Instructions for downloading the latest firmware are available on the NETGEAR support website.