» ISP News » 

Trustwave Find Multiple Vulnerabilities in NETGEAR Broadband Routers

Thursday, February 8th, 2018 (6:00 pm) - Score 2,385

Digital security specialist Trustwave has this evening detailed 5 recently discovered vulnerabilities in NETGEAR routers, which affects multiple models and this includes some of the more recent hardware (e.g. R/D8500). Time to patch your firmware.. again.

According to Trustwave’s SpiderLabs division, the vulnerabilities range from exploits that would allow an attacker to access administrative credentials (i.e. by manipulating a password recovery feature) to reading any file or executing any command on the device.

The risk is significant and if you own any of the following routers or broadband modem routers then it’s time to update the firmware. NETGEAR has already corrected the flaws ahead of this publication.

List of NETGEAR Routers At Risk

Unfortunately this isn’t NETGEAR’s first rodeo and they, like many other manufacturers, have had to deal with quite a lot of problems over the past few years (examples here, here and here). As for the vulnerabilities themselves, they are as follows below.

The Five Vulnerabilities

TWSL2018-002: Password Recovery and File Access

Trustwave SpiderLabs Advisory

NETGEAR advisory

Some routers allow arbitrary file reading from the device provided that the path to file is known. Total of 17 products are affected.

TWSL2018-003: Finding 1: Post-Authentication Command Injection

Trustwave SpiderLabs Advisory

NETGEAR advisory

This one affects six products and reflects a root level OS command execution via the device_name parameter on the lan.cgi page, although the attack requires authentication.

TWSL2018-003: Finding 2: Authentication Bypass

NETGEAR advisory

This also affects large set of products (17) and is trivial to exploit. Authentication is bypassed if “&genie=1” is found within the query string.

TWSL2018-003: Chained Attack: Command Injection

NETGEAR advisory

This is a three-stage attack leveraging three separate issues: CSRF token recovery vulnerability and the two findings in TWSL2018-003. As a result, any user connected to the router can run OS commands as root on the device without providing any credentials.

TWSL2018-004: Command Injection Vulnerability on D7000, EX6200v2 and Some Routers

Trustwave SpiderLabs Advisory

NETGEAR advisory

Only 6 products are affected, this allows to run OS commands as root during short time window when WPS is activated.

Share with Twitter
Share with Linkedin
Share with Facebook
Share with Reddit
Share with Pinterest
By Mark Jackson
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on Twitter, , Facebook and Linkedin.
Leave a Comment
7 Responses
  1. Tom says:

    I owned a R9000 (needs to be added to your list).

    3 weeks ago I was hacked, all settings, passwords changed, and even Firmware updated. All via Wi-Fi.

    Netgear is keeping an extremely low profile about this.

    Following this very serious incident and a few others since I bought the R9000 last summer, I asked Netgear to take back all their equipment back and to refund me in full.

    Netgear have accepted, as soon as I threatened to takeLegal action.

    Obviously, they are aware of these serious security issues and are incapable to fix them.

    1. Mark Jackson says:

      The R9000 isn’t officially listed as being affected by any of the above listed problems, so maybe it’s a different issue or they’ve overlooked something.

    2. baby_frogmella says:

      Strange, I’ve been using a R9000 since Dec 2016 and not had it hacked (I use WPA2 encryption) or heard reports of it being hacked through wifi. It might be a good idea to post exactly what happened on SNB forums (Netgear section) and/or the official Netgear forums, It would give Netgear staff a chance to look into this and if necessary, fix this issue for other users at least. Their phone support staff aren’t that great technically so I would stay away from them.

  2. Dude Lebowski says:

    Are you referring to this blog post? https://www.trustwave.com/Resources/SpiderLabs-Blog/Multiple-Vulnerabilities-in-NETGEAR-Routers/

    If so, they are not new vulnerabilities, but merely a post scriptum about the ones discovered a year ago…

  3. Mike says:

    Would installing 3rd party firmware (ie: DD-WRT) solve this?

    1. Phil says:

      Yes – because these are issues in the Netgear firmware, rather than the hardware (which is essentially just a board with other peoples chips on it).

      I’ve got an R7800 and run LEDE (long story, it was a fork of OpenWRT and is now becoming the new basis for OpenWRT) – which you can install a heap of packages for – the only thing you lose is the hardware acceleration, but I’ve got a build using Qalcomm fast path and can do 1Gbps wan to lan with ease.

  4. Dude Lebowski says:

    Read the blog post – these are not new issues, but rather technical details of the issues found last year and fixed as of September.

    The very first line in the blog post on Trustwave says as much:

    “Last year I discovered multiple vulnerabilities in NETGEAR products. Now that these vulnerabilities have gone through the disclosure process and have been patched we can discuss the technical details.”

    At the end:

    “Trustwave SpiderLabs has worked with NETGEAR through our responsible disclosure process to make sure that these vulnerabilities are addressed.”

    Yet news sites jump the gun and miss the point. So much for “responsible disclosure” 😉

Comments are closed.

Comments RSS Feed

Javascript must be enabled to post (most browsers do this automatically)

Privacy Notice: Please note that news comments are anonymous, which means that we do NOT require you to enter any real personal details to post a message. By clicking to submit a post you agree to storing your comment content, display name, IP, email and / or website details in our database, for as long as the post remains live.

Only the submitted name and comment will be displayed in public, while the rest will be kept private (we will never share this outside of ISPreview, regardless of whether the data is real or fake). This comment system uses submitted IP, email and website address data to spot abuse and spammers. All data is transferred via an encrypted (https secure) session.

NOTE 1: Sometimes your comment might not appear immediately due to site cache (this is cleared every few hours) or it may be caught by automated moderation / anti-spam.

NOTE 2: Comments that break our rules, spam, troll or post via known fake IP/proxy servers may be blocked or removed.
Cheapest Ultrafast ISPs
  • Gigaclear £17.00
    Speed: 200Mbps, Unlimited
    Gift: None
  • Community Fibre £20.00
    Speed: 150Mbps, Unlimited
    Gift: None
  • Hyperoptic £22.00
    Speed: 158Mbps, Unlimited
    Gift: None
  • Virgin Media £24.00
    Speed: 108Mbps, Unlimited
    Gift: None
  • Vodafone £25.00
    Speed: 100Mbps, Unlimited
    Gift: None
Large Availability | View All
Cheapest Superfast ISPs
  • Hyperoptic £17.99
    Speed 33Mbps, Unlimited
    Gift: None
  • Shell Energy £19.99
    Speed 35Mbps, Unlimited
    Gift: None
  • NOW £20.00
    Speed 36Mbps, Unlimited
    Gift: None
  • Virgin Media £20.00
    Speed 54Mbps, Unlimited
    Gift: None
  • Vodafone £22.00
    Speed 38Mbps, Unlimited
    Gift: None
Large Availability | View All
The Top 20 Category Tags
  1. FTTP (4113)
  2. BT (3151)
  3. Politics (2117)
  4. Building Digital UK (2026)
  5. Openreach (1969)
  6. FTTC (1922)
  7. Business (1832)
  8. Mobile Broadband (1605)
  9. Statistics (1510)
  10. 4G (1378)
  11. FTTH (1371)
  12. Virgin Media (1277)
  13. Ofcom Regulation (1241)
  14. Wireless Internet (1233)
  15. Fibre Optic (1233)
  16. Vodafone (926)
  17. EE (905)
  18. 5G (898)
  19. TalkTalk (821)
  20. Sky Broadband (787)
Helpful ISP Guides and Tips

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms , Privacy and Cookie Policy , Links , Website Rules , Contact