Home
 » ISP News » 
Sponsored Links

Trustwave Find Multiple Vulnerabilities in NETGEAR Broadband Routers

Thursday, Feb 8th, 2018 (6:00 pm) - Score 2,385

Digital security specialist Trustwave has this evening detailed 5 recently discovered vulnerabilities in NETGEAR routers, which affects multiple models and this includes some of the more recent hardware (e.g. R/D8500). Time to patch your firmware.. again.

According to Trustwave’s SpiderLabs division, the vulnerabilities range from exploits that would allow an attacker to access administrative credentials (i.e. by manipulating a password recovery feature) to reading any file or executing any command on the device.

The risk is significant and if you own any of the following routers or broadband modem routers then it’s time to update the firmware. NETGEAR has already corrected the flaws ahead of this publication.

Advertisement

List of NETGEAR Routers At Risk
DGN2200v4
R6100
R6220
R6250
R6300v2
R6400
R6400v2
R6700
R6900
R6900P
R7000
R7000P
R7100LG
R7300DST
R7500
R7500v2
R7800
D7800
R7900
R8000
R8300
R8500
D8500
WNDR3400v3
WNDR4500v2
EX6200v2

Unfortunately this isn’t NETGEAR’s first rodeo and they, like many other manufacturers, have had to deal with quite a lot of problems over the past few years (examples here, here and here). As for the vulnerabilities themselves, they are as follows below.

The Five Vulnerabilities

TWSL2018-002: Password Recovery and File Access

Trustwave SpiderLabs Advisory

NETGEAR advisory

Some routers allow arbitrary file reading from the device provided that the path to file is known. Total of 17 products are affected.

TWSL2018-003: Finding 1: Post-Authentication Command Injection

Trustwave SpiderLabs Advisory

NETGEAR advisory

This one affects six products and reflects a root level OS command execution via the device_name parameter on the lan.cgi page, although the attack requires authentication.

TWSL2018-003: Finding 2: Authentication Bypass

NETGEAR advisory

This also affects large set of products (17) and is trivial to exploit. Authentication is bypassed if “&genie=1” is found within the query string.

TWSL2018-003: Chained Attack: Command Injection

NETGEAR advisory

This is a three-stage attack leveraging three separate issues: CSRF token recovery vulnerability and the two findings in TWSL2018-003. As a result, any user connected to the router can run OS commands as root on the device without providing any credentials.

TWSL2018-004: Command Injection Vulnerability on D7000, EX6200v2 and Some Routers

Trustwave SpiderLabs Advisory

NETGEAR advisory

Only 6 products are affected, this allows to run OS commands as root during short time window when WPS is activated.

Mark-Jackson
By Mark Jackson
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on X (Twitter), Mastodon, Facebook and .
Search ISP News
Search ISP Listings
Search ISP Reviews
Comments
7 Responses

Advertisement

  1. Avatar photo Tom says:

    I owned a R9000 (needs to be added to your list).

    3 weeks ago I was hacked, all settings, passwords changed, and even Firmware updated. All via Wi-Fi.

    Netgear is keeping an extremely low profile about this.

    Following this very serious incident and a few others since I bought the R9000 last summer, I asked Netgear to take back all their equipment back and to refund me in full.

    Netgear have accepted, as soon as I threatened to takeLegal action.

    Obviously, they are aware of these serious security issues and are incapable to fix them.

    1. Mark-Jackson Mark Jackson says:

      The R9000 isn’t officially listed as being affected by any of the above listed problems, so maybe it’s a different issue or they’ve overlooked something.

    2. Avatar photo baby_frogmella says:

      Strange, I’ve been using a R9000 since Dec 2016 and not had it hacked (I use WPA2 encryption) or heard reports of it being hacked through wifi. It might be a good idea to post exactly what happened on SNB forums (Netgear section) and/or the official Netgear forums, It would give Netgear staff a chance to look into this and if necessary, fix this issue for other users at least. Their phone support staff aren’t that great technically so I would stay away from them.

  2. Avatar photo Dude Lebowski says:

    Are you referring to this blog post? https://www.trustwave.com/Resources/SpiderLabs-Blog/Multiple-Vulnerabilities-in-NETGEAR-Routers/

    If so, they are not new vulnerabilities, but merely a post scriptum about the ones discovered a year ago…

  3. Avatar photo Mike says:

    Would installing 3rd party firmware (ie: DD-WRT) solve this?

    1. Avatar photo Phil says:

      Yes – because these are issues in the Netgear firmware, rather than the hardware (which is essentially just a board with other peoples chips on it).

      I’ve got an R7800 and run LEDE (long story, it was a fork of OpenWRT and is now becoming the new basis for OpenWRT) – which you can install a heap of packages for – the only thing you lose is the hardware acceleration, but I’ve got a build using Qalcomm fast path and can do 1Gbps wan to lan with ease.

  4. Avatar photo Dude Lebowski says:

    Read the blog post – these are not new issues, but rather technical details of the issues found last year and fixed as of September.

    The very first line in the blog post on Trustwave says as much:

    “Last year I discovered multiple vulnerabilities in NETGEAR products. Now that these vulnerabilities have gone through the disclosure process and have been patched we can discuss the technical details.”

    At the end:

    “Trustwave SpiderLabs has worked with NETGEAR through our responsible disclosure process to make sure that these vulnerabilities are addressed.”

    Yet news sites jump the gun and miss the point. So much for “responsible disclosure” 😉

Comments are closed

Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: None
NOW UK ISP Logo
NOW £24.00
100Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £25.00
132Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £26.50 - 27.00
150Mbps
Gift: None
Sky Broadband UK ISP Logo
145Mbps
Gift: None
Large Availability | View All
Cheapest ISPs for 100Mbps+
Brsk UK ISP Logo
Brsk £19.00
150Mbps
Gift: None
Gigaclear UK ISP Logo
Gigaclear £19.00
300Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: None
YouFibre UK ISP Logo
YouFibre £22.99
150Mbps
Gift: None
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Large Availability | View All
The Top 15 Category Tags
  1. FTTP (5917)
  2. BT (3618)
  3. Politics (2679)
  4. Business (2396)
  5. Openreach (2387)
  6. Building Digital UK (2312)
  7. Mobile Broadband (2099)
  8. FTTC (2074)
  9. Statistics (1871)
  10. 4G (1771)
  11. Virgin Media (1724)
  12. Ofcom Regulation (1554)
  13. Fibre Optic (1455)
  14. Wireless Internet (1445)
  15. FTTH (1384)
Promotion
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms , Privacy and Cookie Policy , Links , Website Rules , Contact
Mastodon