CVE-2024-30568

An attacker can inject malicious system commands via the c4-IPAddr parameter, which is not properly validated or filtered by the device software. Based on the parameter name and references pointing to the ping_test function, the vulnerability likely relates to the router's diagnostic functionality. A crafted network request containing a command injection payload can be executed with the privileges of the process handling the given parameter.

A remote, unauthenticated attacker can execute arbitrary system commands on the device, leading to complete takeover of the router, including violations of confidentiality, integrity, and availability of data and the network.

Patches available from the manufacturer should be applied according to references (https://www.netgear.com/about/security/). Until an update is applied, it is recommended to restrict access to the device's administrative interface only from trusted hosts and to disable remote access to the management panel.

Netgear R6850 with firmware version 1.1.0.88