Netgear security issue exposes 10,000 routers to password hijacking
2 min. read
Updated on
Share this article
Read our disclosure page to find out how can you help Windows Report sustain the editorial team Read more
Now is the right time to seriously update the firmware for your Netgear router after security firm Trustwave found a new vulnerability that leaves at least 10,000 routers exposed to password hijacking. The flaw in 31 Netgear router models exposes the device’s web GUI password to cyber attackers.
The security issue comes hot on the heels of a previous vulnerability discovered in December last year that stemmed from an issue with outdated firmware, something Netgear was quick to release a patch and fix late last year.
The new vulnerability, however, leaves the administrator password in certain Netgear routers susceptible to hackers. Trustwave reveals that several security vulnerabilities have been targeting Netgear routers since April 2016. Despite many instances of alerting Netgear to the problem, Trustwave did not receive a response from the company. Nonetheless, Netgear finally issued a security bulletin to tackle the flaw.
Simon Kenin, a researcher at Trustwave, described the flaw in a blog post:
After few trials and errors trying to reproduce the issue, I found that the very first call to passwordrecovered.cgi will give out the credentials no matter what the parameter you send. This is  a totally new bug that I haven’t seen anywhere else. When I tested both bugs on different Netgear models, I found that my second bug works on a much wider range of models.
Kenin noted that enabling the two vulnerabilities require either a physical or a remote access to a router:
The vulnerability can be used by a remote attacker if remote administration is set to be Internet facing. By default this is not turned on. However, anyone with physical access to a network with a vulnerable router can exploit it locally. This would include public wifi spaces like cafés and libraries using vulnerable equipment.
Trustwave estimates that the bugs could affect hundreds of thousands of Netgear devices. The company now urges users of Netgear routers to check this Knowledge Base Article for instructions to test your device for vulnerability. The guide also provides instructions on how to apply patched firmware for vulnerable routers.
RELATED STORIES YOU NEED TO CHECK OUT:
