Netgear security issue exposes 10,000 routers to password hijacking

2 minute read

Home » News » Netgear security issue exposes 10,000 routers to password hijacking

Now is the right time to seriously update the firmware for your Netgear router after security firm Trustwave found a new vulnerability that leaves at least 10,000 routers exposed to password hijacking. The flaw in 31 Netgear router models exposes the device’s web GUI password to cyber attackers.

The security issue comes hot on the heels of a previous vulnerability discovered in December last year that stemmed from an issue with outdated firmware, something Netgear was quick to release a patch and fix late last year.

The new vulnerability, however, leaves the administrator password in certain Netgear routers susceptible to hackers. Trustwave reveals that several security vulnerabilities have been targeting Netgear routers since April 2016. Despite many instances of alerting Netgear to the problem, Trustwave did not receive a response from the company. Nonetheless, Netgear finally issued a security bulletin to tackle the flaw.

Simon Kenin, a researcher at Trustwave, described the flaw in a blog post:

After few trials and errors trying to reproduce the issue, I found that the very first call to passwordrecovered.cgi will give out the credentials no matter what the parameter you send. This is   a totally new bug that I haven’t seen anywhere else. When I tested both bugs on different Netgear models, I found that my second bug works on a much wider range of models.

Kenin noted that enabling the two vulnerabilities require either a physical or a remote access to a router:

The vulnerability can be used by a remote attacker if remote administration is set to be Internet facing. By default this is not turned on. However, anyone with physical access to a network with a vulnerable router can exploit it locally. This would include public wifi spaces like cafés and libraries using vulnerable equipment.

Trustwave estimates that the bugs could affect hundreds of thousands of Netgear devices. The company now urges users of Netgear routers to check this Knowledge Base Article for instructions to test your device for vulnerability. The guide also provides instructions on how to apply patched firmware for vulnerable routers.

RELATED STORIES YOU NEED TO CHECK OUT:

Discussions

Next up

Gears 5 players want more characters in the game

John Taylor avatar. By: John Taylor
2 minute read

Gears 5 is the latest installment in the Gears of War series and has taken the gaming community by storm. Unfortunately, it had a rough […]

Continue Reading

Revolut login not working? Try these methods

Tashreef Shareef avatar. By: Tashreef Shareef
3 minute read

Revolut is a popular banking app offering financial services for smartphone users with features like a pre-paid debit card, currency exchange, peer-to-peer payment, and more. […]

Continue Reading

Do this if you experience Borderlands 3 FPS drops

John Taylor avatar. By: John Taylor
3 minute read

Borderlands 3 is an action role-playing first-person shooter video game that is currently at its 4th installment. Like any sequel, it is far superior to […]

Continue Reading