Story image

Full list of NETGEAR router vulnerabilities revealed - is your device on the list?

09 Feb 18

Many NETGEAR routers were subject to vulnerabilities that allowed attackers to take control of the devices through a password recovery feature.

Trustwave Spiderlabs researcher Martin Rakhmanov discovered the vulnerabilities last year. After a period of responsible disclosure and patching, he has revealed the five vulnerabilities:

1: Password recovery and file access on some routers and modem routers (PSV-2017-0677)

This vulnerability allows an attacker to read any file on the device as well as accessing administrative credentials by manipulating a password recovery feature.

This vulnerability affects 17 different Netgear products.

  • D8500 running firmware versions 1.0.3.27 and earlier
  • DGN2200v4 running firmware versions 1.0.0.82 and earlier
  • R6300v2 running firmware versions 1.0.4.06 and earlier
  • R6400 running firmware versions 1.0.1.20 and earlier
  • R6400v2 running firmware versions 1.0.2.18 and earlier
  • R6700 running firmware versions 1.0.1.22 and earlier
  • R6900 running firmware versions 1.0.1.20 and earlier
  • R7000 running firmware versions 1.0.7.10 and earlier
  • R7000P running firmware versions 1.0.0.58 and earlier
  • R7100LG running firmware versions 1.0.0.28 and earlier
  • R7300DST running firmware versions 1.0.0.52 and earlier
  • R7900 running firmware versions 1.0.1.12 and earlier
  • R8000 running firmware versions 1.0.3.46 and earlier
  • R8300 running firmware versions 1.0.2.86 and earlier
  • R8500 running firmware versions 1.0.2.86 and earlier
  • WNDR3400v3 running firmware versions 1.0.1.8 and earlier
  • WNDR4500v2 running firmware versions 1.0.0.62 and earlier

2: Post-authentication command injection on some router and modem routers (PSV-2017-1207)

Allows any logged in user to execute any existing command on the appliance as root.

This vulnerability affects six different Netgear products.

  • D8500 running firmware versions 1.0.3.28 and earlier
  • R6400 running firmware versions 1.0.1.22 and earlier
  • R6400v2 running firmware versions 1.0.2.18 and earlier
  • R8300 running firmware versions 1.0.2.94 and earlier
  • R8500 running firmware versions 1.0.2.94 and earlier
  • R6100 running firmware versions 1.0.1.12 and earlier

3: Authentication bypass on some router and modem routers (PSV-2017-1208)

Allows any attacker to bypass the need to authenticate. This vulnerability affects 17 different Netgear products.

  • D6220, running firmware versions prior to 1.0.0.26
  • D6400, running firmware versions prior to 1.0.0.60
  • D8500, running firmware versions prior to 1.0.3.29
  • R6250, running firmware versions prior to 1.0.4.12
  • R6400, running firmware versions prior to 1.01.24
  • R6400v2, running firmware versions prior to 1.0.2.30
  • R6700, running firmware versions prior to 1.0.1.22
  • R6900, running firmware versions prior to 1.0.1.22
  • R6900P, running firmware versions prior to 1.0.0.56
  • R7000, running firmware versions prior to 1.0.9.4
  • R7000P, running firmware versions prior to 1.0.0.56
  • R7100LG, running firmware versions prior to 1.0.0.32
  • R7300DST, running firmware versions prior to 1.0.0.54
  • R7900, running firmware versions prior to 1.0.1.18
  • R8000, running firmware versions prior to 1.0.3.44
  • R8300, running firmware versions prior to 1.0.2.100_1.0.82
  • R8500, running firmware versions prior to 1.0.2.100_1.0.82

4: Chained attack for command injection on some routers and modem routers (PSV-2017-1209)

By combining these vulnerabilities together any user connected to the router can run OS commands as root on the device without providing any credentials.

This vulnerability affects 17 different Netgear products.

  • D6220, running firmware versions prior to 1.0.0.26
  • D6400, running firmware versions prior to 1.0.0.60
  • D8500, running firmware versions prior to 1.0.3.29
  • R6250, running firmware versions prior to 1.0.4.12
  • R6400, running firmware versions prior to 1.01.24
  • R6400v2, running firmware versions prior to 1.0.2.30
  • R6700, running firmware versions prior to 1.0.1.22
  • R6900, running firmware versions prior to 1.0.1.22
  • R6900P, running firmware versions prior to 1.0.0.56
  • R7000, running firmware versions prior to 1.0.9.4
  • R7000P, running firmware versions prior to 1.0.0.56
  • R7100LG, running firmware versions prior to 1.0.0.32
  • R7300DST, running firmware versions prior to 1.0.0.54
  • R7900, running firmware versions prior to 1.0.1.18
  • R8000, running firmware versions prior to 1.0.3.44
  • R8300, running firmware versions prior to 1.0.2.100_1.0.82
  • R8500, running firmware versions prior to 1.0.2.100_1.0.82

5: Command injection vulnerability on D7000, EX6200v2, and some routers (PSV-2017-2181)

Setting a specific "device_name" parameter allows any user to execute any command if they use WPS to join the network.

This vulnerability affects six different Netgear products.

  • R6100 running firmware versions prior to 1.0.1.14
  • R7500 running firmware versions prior to 1.0.0.110
  • R7500v2 running firmware versions prior to 1.0.3.16
  • R7800 running firmware versions prior to 1.0.2.32
  • EX6200v2 running firmware versions prior to 1.0.1.50
  • D7800 running firmware versions prior to 1.0.1.22

Netgear and Trustwave both urge all device owners to update their firmware by visiting Netgear support, entering their router's model number, downloading and installing the latest firmware for their device.

Royole's FlexPai: So bendable phablets are a reality now
A US-based firm called Royole is delivering on that age-old problem of not being able to fold up your devices (who hasn't ever wished they could fold their phone up...)
Hands-on review: Having fun in Knowledge is Power: Decades and Chimparty
They don’t revolutionise social video gaming, but they are enjoyable enough to occupy you during a wet weekend. 
Kiwis losing $24.7mil to scam calls every year
The losses are almost five times higher compared to the same period last year, from reported losses alone.
Tile's Mate & Pro Bluetooth trackers land in NZ
If your car keys (or your tablet) have disappeared into the void at the back of the couch or if you left them somewhere in your car, retracing your steps to find them could be a thing of the past.
Government still stuck in the past? Not on GovTech's watch
What exactly is GovTech and what’s been happening in our capital city?
"Is this for real?" The reality of fraud against New Zealanders
Is this for real? More often than not these days it can be hard to tell, and it’s okay to be a bit suspicious, especially when it comes to fraud.
Hands-on review: The iPhone Xs
The iPhone Xs is a win that brought numerous new and exciting features to the market.
How much does your Amazon Prime Video subscription really get you?
For our NZ$8.90 per month, the average cost per title is US$0.00126 - but we only really get a choice of 416 TV shows and 4321 movies. Choice is a little bit limited compared to other countries.