Netgear fixes dangerous code execution bug in multiple routers

guest · Sep 21, 2021

Netgear fixes dangerous code execution bug in multiple routers
September 21, 2021
https://www.bleepingcomputer.com/ne...erous-code-execution-bug-in-multiple-routers/

Netgear has fixed a high severity remote code execution (RCE) vulnerability found in the Circle parental control service, which runs with root permissions on almost a dozen modern Small Offices/Home Offices (SOHO) Netgear routers.

While one would expect the attack vector exposed by Circle security flaw (tracked as CVE-2021-40847) would be removed after the service is stopped, the Circle update daemon containing the bug is enabled by default and it can be exploited even if the service is disabled.

"The update process of the Circle Parental Control Service on various Netgear routers allows remote attackers with network access to gain RCE as root via a Man-in-the-Middle (MitM) attack," GRIMM security researcher Adam Nichols explained.
Click to expand...

Successfully exploiting this vulnerability requires the attackers to modify network traffic or intercept traffic while on the same network to gain RCE as root on the targeted router.

In a security advisory published on Monday, Netgear urged customers to download the latest firmware for their devices as soon as possible.
The complete list of Netgear routers vulnerable to CVE-2021-40847 exploits and patched firmware versions are listed below.
Click to expand...

guest · Sep 21, 2021

NETGEAR Releases Security Updates for RCE Vulnerability
September 21, 2021
https://us-cert.cisa.gov/ncas/curre...r-releases-security-updates-rce-vulnerability

NETGEAR has released security updates to address a remote code execution vulnerability—CVE-2021-40847—in multiple NETGEAR routers. A remote attacker could exploit this vulnerability to take control of an affected system.

CISA encourages users and administrators to review NETGEAR’s Security Advisory and update to the latest firmware. Given the increase in telework, CISA recommends that CISOs consider the risk that these vulnerabilities present to business networks. Review CISA’s Tip on Home Network Security for more information.
Click to expand...

guest · Nov 17, 2021

Netgear Patches Code Execution Vulnerability Affecting Many Products
November 17, 2021
https://www.securityweek.com/netgear-patches-code-execution-vulnerability-affecting-many-products

Tracked as CVE-2021-34991 (CVSS score of 8.8), the vulnerability is described as a pre-authentication buffer overflow and was found to affect a device’s Universal Plug-and-Play (UPnP) daemon.

Netgear SOHO devices affected by the bug include routers, modems, and WiFi range extenders, and GRIMM’s researchers say they were able to devise an exploit capable of compromising even fully patched devices that are running the default configuration.
Click to expand...

The security researchers have released proof-of-concept (PoC) code that exploits the vulnerability and also published a detailed technical analysis of the security error.

Netgear has announced the availability of patches that address the vulnerability in numerous device models, including extenders, routers, DSL modem routers, aircards, and cable modems, encouraging users to download and install the fixes as soon as possible.

“NETGEAR is developing and testing additional firmware fixes, which we will release as they become available,” the company also announced.
Click to expand...

guest · Dec 6, 2021

Netgear router flaws exploitable with authentication ... like the default creds on Netgear's website
Don't just install the patch, change your router passwords too
December 3, 2021

Two arbitrary code execution vulnerabilities affecting a number of Netgear routers aimed at small businesses have been patched following research by Immersive Labs.

The vulns rely on authenticated access to affected devices so aren't an immediate threat. They do, however, allow someone with remote access to the router to pwn the device's underlying OS, threatening the security of data passing through the router.
Click to expand...

Helpfully, Netgear itself publishes default login credentials for "most" of its products on its website. If you haven't been into your Netgear router's admin panel and changed these default creds, you're at increased risk.

"This kind of command injection also adds persistence which means even if the router is restarted or updated, the vulnerability can persist," said Immersive Labs in a blog post about its findings.
Click to expand...

Immersive said it had found a third exploitable vuln disclosing the device's serial number, which is used in Netgear's password reset process as an authentication measure.

"Netgear strongly recommends that you download the latest firmware as soon as possible," said Immersive.
Click to expand...

Log in or Sign up

Netgear fixes dangerous code execution bug in multiple routers

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Netgear fixes dangerous code execution bug in multiple routers

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches