Which Netgear Firmware Version Had Security Flaw?

Which Netgear Firmware Version Had Security Flaw?

Near 2 months later a high-severity flaw was disclosed – and seven months after it was showtime reported – Netgear has withal to issue fixes for 45 of its router models.

UPDATE

Netgear will non patch 45 router models that are vulnerable to a high-severity remote code execution flaw, the router company revealed terminal calendar week. However, the company says that routers that won’t receive updates are outdated or have reached EOL (End of Life).

The
remote lawmaking execution vulnerability
in question,
which was disclosed June 15, allows network-adjacent attackers to bypass authentication on vulnerable Netgear routers – sans authentication. The high-severity flaw affects 79 Netgear Wi-Fi routers and home gateway models – just Netgear says that 45 of those router models are outside of its “security support period.”

“Netgear has provided firmware updates with fixes for all supported products previously disclosed by ZDI and Grimm,” Netgear said in a
press argument. “The remaining products included in the published listing are outside of our support window. In this specific instance, the parameters were based on the concluding auction engagement of the product into the aqueduct, which was set at 3 years or longer.”


Which Netgear Firmware Version Had Security Flaw?

A full listing of the router models that won’t be patched – likewise equally those that have fixes being rolled out –
is bachelor on Netgear’south website.

“When we look at support windows, some of our products last five or 6 years, while others last simply a few years,” David Henry, senior vice president of Connected Home products at Netgear, told Threatpost. “When we launch a product, as it gets former information technology goes into End of Life (EOL) and we stop edifice information technology and wind down [sales into the channel].”

Read:  Epson Et-3700 How to Roll Back Firmware

For case, one such Modem Router that won’t receive an update, the AC1450 series, is as former as 2009. Other router models, while newer, accept reached EOL: TheR6200 and R6200v2
wireless routers reached EOL in 2013 and 2016, respectively; while the Nighthawk
R7300DST
wireless router reached EOL in the first one-half of 2017, said Henry.

Regardless, Henry stressed that customers using both newer and older router models stay updated on security updates, also as adopting best security practices, including turning off features similar remote access or irresolute admin passwords (which he said is enforced past Netgear).

“I recollect it is really important that customers are paying attending to the updates we send out quarterly on our products,” said Henry.

The Flaw

According to the
Nil Day Initiative
(ZDI), which offset disclosed the consequence, the flaw exists inside the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stock-still-length, stack-based buffer. An attacker can leverage this flaw to execute code in the context of root, according to ZDI.

“Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines,” co-ordinate to ZDI. “Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, well-nigh notably with firewall rules/whitelisting.”

The flaw was reported to Netgear on Jan. 8, 2020, and on June 15, 2020 the security advisory for the flaw was publicly released without a patch available. Additionally, a PoC exploit was published by the
GRIMM blog on June 15.

Read:  Firmware Samsung Galaxy S4 Mini Duos Gt I9192

Netgear has rolled out patches for 34 of the vulnerable models since the flaw was disclosed.  That includes releasing “security hotfixes” for the models, which are fixes that are applied on top of existing, fully tested firmware.

“Releasing hotfixes allows Netgear to apace update existing products and streamline the firmware verification process without going through full regression testing,” according to Netgear. “These hotfixes are targeted at specific security issues and should have minimal effect on other areas of the production’south code.”

Patch Timeline Backlash

Several security experts are criticizing Netgear for its patching policies and procedures. Brian Gorenc, senior director of vulnerability research and head of Trend Micro’southward Zero Day Initiative (ZDI) plan, told Threatpost that the vulnerabilities disclosed stand for some of the nigh severe issues categories bachelor.

“Unfortunately, there are too many examples of vendors abandoning devices that are notwithstanding in wide use – sometimes even when they are still available to buy,” Gorenc told Threatpost. “Possibly we need to recommend manufacturers who support their products for longer – specially in our digitally connected lives. If nosotros reward expert communications and long-term back up from vendors, perchance this abandonment problem will get improve.”

Zach Varnell, senior AppSec consultant at nVisium, said that the disclosure on this vulnerability “appears to be more than generous since the researcher followed responsible disclosure practices and even gave an extension when asked for it.”

“Information technology’s unfortunate for anyone who owns one of those routers but that’s the reality of product lifecycles,” said Varnell. “Basically everything – including software, toys, cars, electronics, appliances – will reach an age where their manufacturer will no longer support them. The elapsing of support varies widely and software tends to be on the shorter side since new development is done much more than rapidly than hardware.”

Read:  How to Downgrade Firmware on Hp Deskjet 6950

“Consumers should ever ensure their devices are nevertheless supported by manufacturers and check the available back up earlier purchasing a new device,” said Gorenc.

Vulnerabilities in routers have been discovered several times over the past year. In March,
Netgear warned users
of a critical remote code execution bug that could permit an unauthenticated attacker to accept control of its Wireless Ac Router Nighthawk (R7800) hardware running firmware versions prior to 1.0.2.68. In July, a pair of
flaws in ASUS routers
for the home were uncovered that could allow an attacker to compromise the devices – and eavesdrop on all of the traffic and data that flows through them.

This article was updated on Aug. 4 at xi:thirty am ET with further comments from Netgear.


Costless Threatpost Webinar

: Desire to learn more about Confidential Calculating and how it tin supercharge your cloud security? This webinar “
Deject Security Audit: A Confidential Computing Roundtable
” brings top cloud-security experts from Microsoft and

Fortanix together to explore howConfidential Computing is a game changer for securing dynamic cloud information and preventing IP exposure. Join us
Wednesday Aug. 12 at 2pm ET
for this Costlesslive webinar with Dr. David Thaler, software architect, Microsoft and Dr Richard Searle, security architect, Fortanix – both with the Confidential Computing Consortium.
Register Now
.

Which Netgear Firmware Version Had Security Flaw?

Check Also

Can the Ninja Inferno Handle the New Gh5 Firmware Update

Can the Ninja Inferno Handle the New Gh5 Firmware Update

Can the Ninja Inferno Handle the New Gh5 Firmware Update Atomos has launched the Ninja …