Experts warn Netgear router users to unplug the devices after discovering unpatched bug

[midian182]

Security experts have warned that several models of Netgear routers contain a vulnerability that could allow attackers to take almost total control of the devices. A security researcher going by the alias “Aceworm” discovered the flaw and released its details last week. He claims to have informed Netgear about the issue in August but never heard back.

By tricking users connected to the local Netgear network into clicking on a malicious web link, remote attackers can execute arbitrary shell commands with root privileges on affected routers. The vulnerability is the result of the Web interface failing to filter out unauthorized commands contained in URLs.

Netgear has confirmed the vulnerability is present in the following models:

• R6250
• R6400
• R6700
• R7000
• R7100LG
• R7300
• R7900
• R8000

Another security researcher, “Kalypto Pink,” warned in a separate post that other models not listed by Netgear are vulnerable, including the Nighthawk X8 Tri-Band WiFi Router (Model R8500) and Nighthawk X10 Smart WiFi Router (R9000).

In an advisory published on Friday, The U.S. CERT Coordination Center (CERT/CC) at Carnegie Mellon University said: "Exploiting this vulnerability is trivial.”

"Users who have the option of doing so should strongly consider discontinuing use of affected devices until a fix is made available," the organization added.

Netgear says it is still working on a firmware fix for the command injection vulnerability. In the meantime, CERT offers a temporary solution that involves exploiting the flaw in a safe way by issuing a command that disables the router’s web server feature. It can be issued with the following URL:

https://[router_IP]/cgi-bin/;killall$IFS'httpd'

Remember that [router_IP] is replaced with the local IP address assigned to the router. CERT notes that executing this command means the router's web administration will not be available until the device is restarted. 

Netgear is offering a beta version of the firmware fix but warns that it has not been fully tested and might not work for all users. It is currently available for RS6400, RS7000, and R8000 routers, with more models being added today.

Permalink to story.

https://www.techspot.com/news/67381-experts-warn-netgear-router-users-stop-using-devices.html

 

[hkhan1989]

Fortunately for me, I do not use Netgear's FW on my R7000, I use Asuswrt-Merlin FW

 

[fktech]

Netgear has to get its s@#$ together. Current FW on R7000 when it works is still a mess. Netgear ARLO fiasco anyone...

 

[MoeJoe]

For the record, Netgear has been a mess of years so none of this comes as any surprise.

 

[Trillionsin]

What was it that I read a few days ago, or maybe up to a couple weeks ago now? That there were some hacker that had the capability to take over routers, making it so that the owner can no longer access it or fix it.... Just now seeing an article like this much later in time is kind of funny... like, it's been happening, and its not just Netgear... I have no proof... but you couldnt deny the possibility. Whether the companies have officially acknowledged it or are trying to keep it quiet...

Nobody wants to hear that someone hijacked their router. Most would probably be in denial, thinking it couldnt happen to them with their netgear or other brand router.

Sticking to the trend however, I never buy Netgear routers and I've never liked them. Not really much of a reason but personal preference... but this doesnt mean I should dislike them even more... I'm pretty sure that there's a lot of routers out there that are susceptible, like I was saying. Another factor is whether the hacker who discovered the security flaw would want it to be known publicly or use it for their own gain.

 

[OortCloud]

I have an old netgear router downstairs (it replaced an even older netgear router) and acts as an extender. Both this and the previous one were awful as routers and are awful as extenders too. I have to pull the mains out on them at least once a week as bits stop working - especially the wireless.

 

[Squid Surprise]

Anyone know if they've updated the firmware officially yet to fix this?

 

[DelJo63]

NOTICE: The issue is model specific.

I've been exclusively been using Netgear for at least a decade and found them {RP614v2 & WNR2000V4} to be easily configured AND secure - - despite what others have said above.

 

[Squid Surprise]

NOTICE: The issue is model specific.

I've been exclusively been using Netgear for at least a decade and found them {RP614v2 & WNR2000V4} to be easily configured AND secure - - despite what others have said above.

Well, I'd been using WRT open-source firmware on my previous Netgear - and I assume that I can do the same for the newer ones... but I was going to pick one up for my parents and would prefer to just "out of the box" it for them...