Several Netgear Router Models Vulnerable to Device Takeover

Summary

A vulnerability in Netgear routers, present in the web server component of 758 firmware versions used in 79 models going back as far as 2007, could allow a threat actor to take over impacted devices. The server, which is used to power the router’s administration panel, lacks proper security protections that could allow a threat actor to craft malicious HTTP requests to exploit the vulnerability. Researchers from cybersecurity firm GRIMM and internet service provider VNPT discovered the vulnerability and subsequently published proof-of-concept code on GitHub detailing the ability to start the router’s telnet daemon as root without authenticating. Netgear is currently developing patches; however, due to the scope of the vulnerability, they are not yet available.

Recommendations

The NJCCIC recommends users and administrators of impacted Netgear routers update their firmware as soon as patches become available. Technical details and a list of affected model numbers can be found in the GRIMM blog post.