Netgear leaves vulnerabilities unpatched in Nighthawk router
3 mins read

Netgear leaves vulnerabilities unpatched in Nighthawk router


Netgear-modem
Netgear R6700v3
Supply: Netgear

Researchers have discovered half a dozen high-risk vulnerabilities within the newest firmware model for the Netgear Nighthawk R6700v3 router. At publishing time the failings stay unpatched.

Nighthawk R6700 is a well-liked dual-bank WiFi router marketed with gaming-focused options, good parental controls, and inside {hardware} that’s sufficiently highly effective to accommodate the wants of house energy customers.

The six flaws had been found by researchers at cybersecurity firm Tenable and will permit an attacker on the community to take full management of the system:

  • CVE-2021-20173: A post-authentication command injection flaw within the replace performance of the system, making it inclined to command injection.
  • CVE-2021-20174: HTTP is utilized by default on all communications of the system’s internet interface, risking username and password interception in cleartext type.
  • CVE-2021-20175: SOAP Interface (port 5000) makes use of HTTP to speak by default, risking username and password interception in cleartext type.
  • CVE-2021-23147: Command execution as root with out authentication through a UART port connection. Exploiting this flaw requires bodily entry to the system.
  • CVE-2021-45732: Configuration manipulation through hardcoded encryption routines, permitting the altering of settings which can be locked for causes of safety.
  • CVE-2021-45077: All usernames and passwords for the system’s companies are saved in plaintext type within the configuration file.

On high of the aforementioned safety points, Tenable discovered a number of situations of jQuery libraries counting on model 1.4.2, which is thought to include vulnerabilities. The researechers additionally be aware that the system makes use of a MiniDLNA is server model with publicly recognized flaws.

POST request forcing an update check to exploit CVE-2021-20173
POST request forcing an replace test to take advantage of CVE-2021-20173
Supply: Tenable

The just lately disclosed flaws have an effect on firmware model 1.0.4.120, which is the newest launch for the system.

Customers are suggested to vary the default credentials to one thing distinctive and robust and observe really useful safety practices for extra sturdy protection in opposition to malware infections.

Additionally, test Netgear’s firmware obtain portal frequently and set up new variations as quickly as they grow to be out there. Turning on computerized updates in your router can also be really useful.

The present safety report refers to Netgear R6700 v3, which remains to be underneath assist, not Netgear R6700 v1 and R6700 v2, which have reached finish of life. If you’re nonetheless utilizing the older fashions, it’s endorsed to interchange them.

Tenable disclosed the above points to the seller on September 30, 2021, and despite the fact that some data alternate within the type of clarifications and strategies came about afterward, the issues stay unaddressed.

We’ve reached out to Netgear asking for a touch upon the above, and we’ll add an replace to this story as quickly as we hear again from them.

Leave a Reply

Your email address will not be published. Required fields are marked *