Netgear has released an urgent security patch fixing a critical Universal Plug-and-Pwn (UPnP) zero-day vulnerability. The flaw tracked as CVE-2021-34991, is a pre-authentication vulnerability within Netgear SOHO devices that could allow a network-adjacent attacker to escalate their privileges as root for the purpose of performing Remote Code Execution (RCE). The flaw in the UPnP service is exploited when parsing the universally unique identifier (uuid) request header. Although this flaw is critical, the attacker must already have gained access to the LAN to perform the attack, thus receiving a CVSS score of 8.8. A researcher states, “But once they are [have access to LAN], the attacker can send a specially crafted header to the UPnP daemon and can remotely run code with root privileges on the affected device.” Many devices are affected, and Netgear strongly recommends their customers visit the Netgear support site, where they can search for their specific device to download the appropriate firmware update. A link to the Netgear advisory has been linked below, and the CTAPT will continue to report on the most critical vulnerabilities as they are identified.