CVE-2021-33514: Netgear GC108P Firmware RCE Vulnerability

CVE-2021-33514 Overview

CVE-2021-33514 is a pre-authentication command injection vulnerability affecting multiple NETGEAR smart switch devices. The vulnerability exists in the /sqfs/lib/libsal.so.0.0 library used by the CGI application, allowing unauthenticated attackers to execute arbitrary operating system commands remotely. The attack can be demonstrated through the setup.cgi endpoint by injecting malicious commands via the HTTP User-Agent header field using a crafted token parameter.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands with full system privileges on vulnerable NETGEAR smart switches, potentially leading to complete device compromise, network pivoting, and persistent backdoor installation.

Affected Products

• NETGEAR GC108P (firmware before 1.0.7.3)
• NETGEAR GC108PP (firmware before 1.0.7.3)
• NETGEAR GS108Tv3 (firmware before 7.0.6.3)
• NETGEAR GS110TPPv1 (firmware before 7.0.6.3)
• NETGEAR GS110TPv3 (firmware before 7.0.6.3)
• NETGEAR GS110TUPv1 (firmware before 1.0.4.3)
• NETGEAR GS710TUPv1 (firmware before 1.0.4.3)
• NETGEAR GS716TP (firmware before 1.0.2.3)
• NETGEAR GS716TPP (firmware before 1.0.2.3)
• NETGEAR GS724TPPv1 (firmware before 2.0.4.3)
• NETGEAR GS724TPv2 (firmware before 2.0.4.3)
• NETGEAR GS728TPPv2 (firmware before 6.0.6.3)
• NETGEAR GS728TPv2 (firmware before 6.0.6.3)
• NETGEAR GS752TPPv1 (firmware before 6.0.6.3)
• NETGEAR GS752TPv2 (firmware before 6.0.6.3)
• NETGEAR MS510TXM (firmware before 1.0.2.3)
• NETGEAR MS510TXUP (firmware before 1.0.2.3)

Discovery Timeline

• 2021-05-21 - CVE-2021-33514 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-33514

Vulnerability Analysis

This command injection vulnerability (CWE-78) resides in the web management interface of affected NETGEAR smart switches. The vulnerable component is the libsal.so.0.0 shared library, which is utilized by CGI scripts handling web requests. The flaw stems from improper sanitization of user-controlled input before it is passed to system shell functions.

The attack requires no authentication, making it particularly dangerous for devices exposed to untrusted networks. An attacker can craft a malicious HTTP request targeting the setup.cgi endpoint with a specially formatted token parameter that breaks out of the expected input context and injects shell commands. The HTTP User-Agent header is then interpreted and executed as part of the system command, granting the attacker arbitrary code execution capabilities with the privileges of the web server process.

Root Cause

The root cause of CVE-2021-33514 is insufficient input validation and improper neutralization of special characters in the libsal.so.0.0 library. The CGI application fails to properly sanitize the token parameter and HTTP headers before incorporating them into shell commands. Specifically, single quotes and semicolons in the token parameter can be used to escape the intended command context, allowing subsequent injection of arbitrary commands through the $HTTP_USER_AGENT environment variable.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker with network access to the switch's web management interface can exploit this vulnerability by sending a crafted HTTP GET request to the setup.cgi endpoint. The attack payload is delivered through the token parameter combined with the User-Agent HTTP header.

The exploitation technique follows this pattern: the token parameter is crafted to include shell metacharacters (;') that break out of the expected string context, and the $HTTP_USER_AGENT shell variable is referenced to inject the actual malicious command placed in the User-Agent header. This allows execution of arbitrary commands such as reverse shells, data exfiltration, or persistence mechanisms.

For technical analysis and detailed exploitation methodology, refer to Gynvael's technical writeup.

Detection Methods for CVE-2021-33514

Indicators of Compromise

• Unusual HTTP requests to setup.cgi containing shell metacharacters (;, ', $) in the token parameter
• Web server logs showing User-Agent headers with shell command syntax (e.g., wget, curl, nc, /bin/sh)
• Unexpected outbound network connections from NETGEAR switch management interfaces
• Presence of unauthorized files or processes on the switch filesystem

Detection Strategies

• Monitor HTTP traffic to switch management interfaces for requests containing the pattern setup.cgi?token= with shell metacharacters
• Implement network intrusion detection rules to identify command injection patterns in HTTP headers targeting CGI endpoints
• Deploy web application firewall rules to block requests with suspicious token parameter values containing quote characters and semicolons
• Audit network logs for anomalous traffic originating from network switch IP addresses

Monitoring Recommendations

• Enable detailed logging on NETGEAR switch web management interfaces and forward logs to a centralized SIEM
• Monitor for unauthorized firmware changes or configuration modifications on affected switches
• Implement network segmentation to isolate switch management interfaces from untrusted network segments
• Set up alerts for any outbound connections from switch management IPs to external addresses

How to Mitigate CVE-2021-33514

Immediate Actions Required

• Update all affected NETGEAR smart switches to the patched firmware versions immediately
• Restrict access to switch management interfaces to trusted administrative networks only
• Disable remote management access if not required for operations
• Implement network access control lists (ACLs) to limit which IP addresses can reach switch management ports

Patch Information

NETGEAR has released firmware updates that address this vulnerability. The fixed firmware versions are: GC108P/GC108PP 1.0.7.3 or later, GS108Tv3/GS110TPPv1/GS110TPv3 7.0.6.3 or later, GS110TUPv1/GS710TUPv1 1.0.4.3 or later, GS716TP/GS716TPP/MS510TXM/MS510TXUP 1.0.2.3 or later, GS724TPPv1/GS724TPv2 2.0.4.3 or later, and GS728TPPv2/GS728TPv2/GS752TPPv1/GS752TPv2 6.0.6.3 or later. Download the appropriate firmware from the NETGEAR Security Advisory PSV-2021-0071.

Workarounds

• Place switch management interfaces on isolated management VLANs not accessible from general network segments
• Configure firewall rules to block all external access to switch web management ports (typically TCP port 80/443)
• Use VPN or jump host architecture to access switch management interfaces from trusted endpoints only
• Consider disabling the web-based management interface entirely and using console/SSH access where supported

# Example ACL configuration to restrict management access
# Apply firewall rules to limit access to switch management IP
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP