Security researchers from SentinelOne have notified the Taiwanese company KCodes about a critical vulnerability (tracked as CVE-2021-45608) affecting their NetUSB component, that if exploited could allow an attacker to perform remote code execution (RCE). KCodes is a USB over IP software development firm that produces third-party USB devices that are compatible with many popular routers like Netgear, TP-Link, DLink, Western Digital, and many more. The affected NetUSB kernel module was developed to give remote devices the ability to connect to different types of routers and access the USB devices which are plugged into them. According to the writeup produced by researcher Max Van Amerongen, they were able to demonstrate a proof-of-concept (PoC) exploit to KCodes, showing exactly how a threat actor might exploit this vulnerability, however the details of the PoC have not been made public yet due to the fact that not all affected vendors have shipped their updates. Because the vulnerability resides in a third-party component licensed to various router vendors, the only way to mitigate this exploit is with a firmware update from each specific vendor that patches the vulnerability. This flaw affects millions of users, and the Ankura CTIX urges our readers to always ensure that their router is running the latest stable firmware for security.