Security News CERT advises users to 'discontinue use' of two Netgear routers due to major security flaw

[Exterminator]

In a major setback for Netgear, it appears that at least two of its high-end routers may contain a severe security flaw according to an advisory issued by CERT.

The vulnerability itself is incredibly easy to leverage and simply relies upon accessing a specially crafted URL in the following format from the local network:

http://< router_IP >/cgi-bin/;COMMAND

The above will result in a command injection attack via the router's web interface which will execute arbitrary commands with root privileges. Notably, the attack can be initiated remotely by an attacker who manages to fool a local user into clicking on a malicious URL hidden behind a shortened link. Otherwise, a nefarious user already on the local network can craft and visit a URL of their choice in order to achieve the same outcome.

So far, the two routers that have been confirmed to be susceptible to this vulnerability are:

• Netgear R6400 with firmware version 1.0.1.6_1.0.4 (and possibly earlier)
• Netgear R7000 with firmware version 1.0.7.2_1.1.93 (and possibly earlier)

While unconfirmed by CERT, one Reddit user indicated that their Netgear R8000 router was also affected by the flaw, which means that the list of impacted hardware may well expand over the coming days.

In terms of a present solution, CERT has advised that it "is currently unaware of a practical solution to this problem" with the only viable workaround being that users "discontinue use" of the routers until a fix is made available from Netgear. Whilst inconvenient, such a mitigation would help prevent affected devices from being enrolled in botnets, including those leveraging the Mirai source code posted online back in October, and used in large-scale DDoS attacks.

Source: CERT via Bleeping Computer

 

[JohnnyLaser]

The CERT has been updated and includes quite a few Netgear routers...

Affected models:

R6250, R6400 (AC1750), R6700, R7000 Nighthawk (AC1900, AC2300), R7100LG, R7300, R7500 Nighthawk X4 (AC2350), R7800 Nighthawk X4S(AC2600), R7900, R8000 Nighthawk (AC3200), R8500 Nighthawk X8 (AC5300), R9000,Nighthawk X10 (AD7200)

CERT advisory issued
Vulnerability Note VU#582384 - Multiple Netgear routers are vulnerable to arbitrary command injection

Netgear acknowledges the problem
Security Advisory for VU 582384 | Answer | NETGEAR Support

Beta firmware now available for: R6400,R7000,R8000

 

[shmu26]

are all of them high-end routers? what about the entry-level routers that you get from your ISP?

 

[jamescv7]

@shmu26: I highly doubt it's included on the security flaw, considering that common routers given by ISP are design for quick and convenience rather on strong security side by default.

 

[soccer97]

The CERT has been updated and includes quite a few Netgear routers...

Affected models:

R6250, R6400 (AC1750), R6700, R7000 Nighthawk (AC1900, AC2300), R7100LG, R7300, R7500 Nighthawk X4 (AC2350), R7800 Nighthawk X4S(AC2600), R7900, R8000 Nighthawk (AC3200), R8500 Nighthawk X8 (AC5300), R9000,Nighthawk X10 (AD7200)

CERT advisory issued
Vulnerability Note VU#582384 - Multiple Netgear routers are vulnerable to arbitrary command injection

Netgear acknowledges the problem
Security Advisory for VU 582384 | Answer | NETGEAR Support

Beta firmware now available for: R6400,R7000,R8000

One of the issuesis that firmware is not regularly updated. There may be 1, or in rare cases 2 patches put out in my past experience, they it's not really supported officially it seems.

It would be good to have more info about ISP routers. Ours was upgraded with more security features and the ability to section off Guest WiFI in order to protect the network if needbe.