CVE-2021-45608: Netgear D7800 Firmware RCE Vulnerability

CVE-2021-45608 Overview

CVE-2021-45608 is an integer overflow vulnerability [CWE-190] in the KCodes NetUSB kernel module used by millions of consumer routers. The flaw resides in the SoftwareBus_dispatchNormalEPMsgOut function and is reachable by an unauthenticated remote attacker. Affected vendors include D-Link, Edimax, NETGEAR, TP-Link, Tenda, and Western Digital. NETGEAR confirmed exposure on D7800 before 1.0.1.68, R6400v2 before 1.0.4.122, and R6700v3 before 1.0.4.122. Remote code execution from the WAN interface on TCP port 20005 cannot be ruled out, though exploitation requires significant complexity.

Critical Impact
An unauthenticated network attacker can trigger a kernel-mode integer overflow leading to heap memory corruption and potential remote code execution on affected routers.

Affected Products

NETGEAR D7800 firmware before 1.0.1.68
NETGEAR R6400v2 firmware before 1.0.4.122
NETGEAR R6700v3 firmware before 1.0.4.122

Discovery Timeline

2021-12-26 - CVE-2021-45608 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-45608

Vulnerability Analysis

The vulnerability lives inside the KCodes NetUSB kernel driver, which exposes a USB-over-IP service on TCP port 20005. The driver runs in kernel context and listens on the LAN interface by default, with some deployments exposing it externally. The bug is an integer overflow during size computation in SoftwareBus_dispatchNormalEPMsgOut when handling attacker-supplied length fields. The undersized allocation that results is followed by a copy of attacker-controlled data, producing a kernel heap overflow. Because NetUSB executes as a Linux kernel module, successful corruption yields code execution at ring 0 on the router. SentinelOne researchers published the technical analysis describing how the size calculation wraps and how the corrupted heap chunk influences adjacent kernel structures.

Root Cause

The driver computes a buffer size by adding an attacker-controlled value to a fixed header length without validating the result. When the supplied value approaches the maximum unsigned 32-bit integer, the addition wraps around to a small value. The driver then calls kmalloc with the wrapped size and proceeds to copy the full attacker-supplied payload into the undersized chunk, overwriting adjacent kernel heap data.

Attack Vector

An unauthenticated attacker reaches the vulnerable code by connecting to TCP port 20005 on the router and issuing a crafted NetUSB protocol message with a malicious size field. No authentication is required and the protocol does not perform a handshake that would prevent malformed packets from reaching the vulnerable dispatcher. From the LAN, exploitation is straightforward in terms of reach; reliable code execution requires defeating kernel heap layout constraints. The original SentinelLabs disclosure rated weaponization as complex but not impossible.

No verified public proof-of-concept code is available for this issue. Refer to the SentinelOne CVE-2021-45608 Analysis for the technical walkthrough of the overflow primitive and constraints on exploitation.

Detection Methods for CVE-2021-45608

Indicators of Compromise

Inbound or LAN-sourced TCP connections to port 20005 on consumer router interfaces
Unexpected reboots, kernel oops messages, or watchdog resets on affected NETGEAR, D-Link, TP-Link, Tenda, Edimax, or Western Digital devices
NetUSB protocol traffic originating from hosts that are not running the vendor's USB-over-IP client

Detection Strategies

Inventory router firmware versions and flag devices running KCodes NetUSB below the vendor-fixed builds
Inspect network telemetry for any connection attempts to TCP 20005, particularly from the WAN side, which should never occur in normal operation
Use deep packet inspection rules to identify malformed NetUSB length fields that approach 32-bit boundaries

Monitoring Recommendations

Continuously monitor edge devices for firmware-version drift against vendor advisories such as NETGEAR PSV-2021-0278
Forward router and gateway syslog data to a centralized data lake for correlation against post-exploitation behavior on internal hosts
Alert on any host attempting to scan port 20005 across internal subnets, which suggests lateral reconnaissance for vulnerable routers

How to Mitigate CVE-2021-45608

Immediate Actions Required

Upgrade affected NETGEAR devices to D7800 1.0.1.68, R6400v2 1.0.4.122, R6700v3 1.0.4.122, or later
Apply equivalent vendor patches for D-Link, TP-Link, Tenda, Edimax, and Western Digital products that ship the KCodes NetUSB module
Verify that TCP port 20005 is not exposed on any WAN-facing interface

Patch Information

NETGEAR addressed CVE-2021-45608 in firmware versions D7800 1.0.1.68, R6400v2 1.0.4.122, and R6700v3 1.0.4.122. Refer to the NETGEAR Security Advisory PSV-2021-0278 for vendor guidance. Other affected vendors released parallel updates for their respective product lines.

Workarounds

Disable the USB-over-IP and NetUSB feature in the router administration interface if the vendor exposes that option
Block inbound and outbound TCP traffic to port 20005 at the network perimeter and on internal segmentation points
Restrict router management to a dedicated VLAN that does not allow access from untrusted client devices

bash

# Block NetUSB port at an upstream Linux gateway
iptables -A FORWARD -p tcp --dport 20005 -j DROP
iptables -A INPUT   -p tcp --dport 20005 -j DROP