Almost 50 Netgear Routers are Vulnerable to Four Security Flaws
- Netgear urges its customers to update their routers’ and gateways’ firmware in order to plug flaws.
- The list of the products that are affected by the disclosed vulnerabilities surpasses the fifty entries.
- The flaws can lead to remote code execution, command injection, and authentication bypass.
Netgear has released four security advisories covering a wide range of their products, urging customers to grab the fixing firmware updates. The flaws concern an unauthenticated remote code execution, post-authentication command injection, pre-authentication command injection, and authentication bypass. Thus, they range from medium to critical severity, and they have a wide range of exploitation potential.
PSV-2019-0076: This is a critical severity vulnerability (CVSS v3 score of 9.4) which enables attackers to carry out remote code execution attacks without authenticating. It affects the “R7800” running firmware versions prior to 1.0.2.68.
PSV-2018-0352: This is a high severity vulnerability (CVSS ve score of 8) which affects many routers and gateways. It concerns a flaw that allows post-authentication command injection. Here is the full list of the affect products:
D6220, running firmware versions prior to 1.0.0.52
D6400, running firmware versions prior to 1.0.0.86
D7000v2, running firmware versions prior to 1.0.0.53
D8500, running firmware versions prior to 1.0.3.44
R6220, running firmware versions prior to 1.1.0.80
R6250, running firmware versions prior to 1.0.4.34
R6260, running firmware versions prior to 1.1.0.64
R6400, running firmware versions prior to 1.0.1.46
R6400v2, running firmware versions prior to 1.0.2.66
R6700, running firmware versions prior to 1.0.2.6
R6700v2, running firmware versions prior to 1.2.0.36
R6700v3, running firmware versions prior to 1.0.2.66
R6800, running firmware versions prior to 1.2.0.36
R6900, running firmware versions prior to 1.0.2.4
R6900P, running firmware versions prior to 1.3.1.64
R6900v2, running firmware versions prior to 1.2.0.36
R7000, running firmware versions prior to 1.0.9.42
R7000P, running firmware versions prior to 1.3.1.64
R7100LG, running firmware versions prior to 1.0.0.50
R7300DST, running firmware versions prior to 1.0.0.70
R7800, running firmware versions prior to 1.0.2.60
R7900, running firmware versions prior to 1.0.3.8
R7900P, running firmware versions prior to 1.4.1.30
R8000, running firmware versions prior to 1.0.4.28
R8000P, running firmware versions prior to 1.4.1.30
R8300, running firmware versions prior to 1.0.2.128
R8500, running firmware versions prior to 1.0.2.128
R8900, running firmware versions prior to 1.0.4.12
R9000, running firmware versions prior to 1.0.4.12
XR500, running firmware versions prior to 2.3.2.32
PSV-2019-0051: This vulnerability concerns a pre-authentication command injection scenario and its severity is ranked as “high” (CVSS v3 score of 8.3). The list of affected products are the following:
R6400v2, running firmware versions prior to 1.0.4.84
R6700, running firmware versions prior to 1.0.2.8
R6700v3, running firmware versions prior to 1.0.4.84
R6900, running firmware versions prior to 1.0.2.8
R7900, running firmware versions prior to 1.0.3.10
PSV-2018-0570: This is a medium severity bug that concerns the possibility to bypass authentication on some Netgear gateways and routers. The affected products are given below:
D6200, running firmware versions prior to 1.1.00.34
D7000, running firmware versions prior to 1.0.1.68
PR2000, running firmware versions prior to 1.0.0.28
R6050, running firmware versions prior to 1.0.1.18
JR6150, running firmware versions prior to 1.0.1.18
R6120, running firmware versions prior to 1.0.0.46
R6220, running firmware versions prior to 1.1.0.80
R6230, running firmware versions prior to 1.1.0.80
R6260, running firmware versions prior to 1.1.0.64
R6700v2, running firmware versions prior to 1.2.0.36
R6800, running firmware versions prior to 1.2.0.36
R6900v2, running firmware versions prior to 1.2.0.36
If you own one of the above devices and your firmware is outdated, you should get the latest version and upgrade it immediately. These flaws could result in the stealing of your personal data, the hijacking of your computers, the planting of malware, the transformation of your system into a spamming or DDoS bot, and many more. For instructions on how to update the firmware of your Netgear router directly from the web browser, watch the below video.