Netgear security issue exposes 10,000 routers to password hijacking

Edward Hudson By: Edward Hudson
2 minute read

Home » Netgear security issue exposes 10,000 routers to password hijacking

Now is the right time to seriously update the firmware for your Netgear router after security firm Trustwave found a new vulnerability that leaves at least 10,000 routers exposed to password hijacking. The flaw in 31 Netgear router models exposes the device’s web GUI password to cyber attackers.

The security issue comes hot on the heels of a previous vulnerability discovered in December last year that stemmed from an issue with outdated firmware, something Netgear was quick to release a patch and fix late last year.

The new vulnerability, however, leaves the administrator password in certain Netgear routers susceptible to hackers. Trustwave reveals that several security vulnerabilities have been targeting Netgear routers since April 2016. Despite many instances of alerting Netgear to the problem, Trustwave did not receive a response from the company. Nonetheless, Netgear finally issued a security bulletin to tackle the flaw.

Simon Kenin, a researcher at Trustwave, described the flaw in a blog post:

After few trials and errors trying to reproduce the issue, I found that the very first call to passwordrecovered.cgi will give out the credentials no matter what the parameter you send. This is   a totally new bug that I haven’t seen anywhere else. When I tested both bugs on different Netgear models, I found that my second bug works on a much wider range of models.

Kenin noted that enabling the two vulnerabilities require either a physical or a remote access to a router:

The vulnerability can be used by a remote attacker if remote administration is set to be Internet facing. By default this is not turned on. However, anyone with physical access to a network with a vulnerable router can exploit it locally. This would include public wifi spaces like cafés and libraries using vulnerable equipment.

Trustwave estimates that the bugs could affect hundreds of thousands of Netgear devices. The company now urges users of Netgear routers to check this Knowledge Base Article for instructions to test your device for vulnerability. The guide also provides instructions on how to apply patched firmware for vulnerable routers.



Next up

People bar to be dropped in upcoming Windows 10 version

Giles Ensor avatar. By: Giles Ensor
2 minute read

Reports are being circulated that Microsoft intends to drop the People bar feature in the Windows 10 19H1 update. The original report came from a […]

Continue Reading

Warning! Nasty new Office 365 phishing attack doing the rounds

Giles Ensor avatar. By: Giles Ensor
2 minute read

A new and very nasty phishing attack has been doing the rounds, and it is extremely difficult to spot. Here is what you need to […]

Continue Reading

6 best personal cloud storage solutions for your files and folders

Daniel Segun By: Daniel Segun
Less than a 1 minute read

Are you looking for the best personal cloud storage application for your Windows 10 PC? Windows Report has got you covered! File storage has come […]

Continue Reading