CVE-2021-23147

Step 1: Physical Access: The attacker gains physical access to the Netgear Nighthawk R6700 router.

Step 2: Hardware Disassembly (Optional): The attacker may need to disassemble the router to access the UART pins on the circuit board. This typically involves removing the router's casing.

Step 3: Serial Connection: The attacker connects a serial cable (e.g., a USB-to-TTL serial adapter) to the UART pins on the router's circuit board. The attacker must identify the correct pins (TX, RX, GND).

Step 4: Terminal Emulation: The attacker uses a terminal emulator (e.g., PuTTY, minicom, screen) on a computer to establish a serial connection to the router. They configure the terminal emulator with the correct baud rate (typically 115200) and other serial communication parameters.

Step 5: Command Execution: The attacker interacts with the root shell via the serial connection. They can then execute arbitrary commands with root privileges, effectively taking full control of the device.

The vulnerability stems from inadequate security measures on the UART (Universal Asynchronous Receiver/Transmitter) console, a serial communication interface typically used for debugging and low-level access. The firmware lacks authentication or authorization checks on the UART port. This allows an attacker to connect to the UART port with a serial connection and execute commands as the root user. The root cause is the absence of any authentication mechanism or access control list (ACL) on the UART console. The device trusts any input received through the UART port, allowing direct execution of commands with elevated privileges.